AWS config medium security documentation change
Summary
Expanded AWS Config role permissions for security services monitoring
Security assessment
Added GuardDuty/SecurityHub permissions enhances security monitoring capabilities
Diff
diff --git a/config/latest/developerguide/security-iam-awsmanpol.md b/config/latest/developerguide/security-iam-awsmanpol.md index 7035ef374..6874d4324 100644 --- a//config/latest/developerguide/security-iam-awsmanpol.md +++ b//config/latest/developerguide/security-iam-awsmanpol.md @@ -179,0 +180,2 @@ Change | Description | Date +AWSConfigServiceRolePolicy – Added permissions: application-autoscaling:DescribeScheduledActions, appsync:GetApiAssociation, cloudformation:DescribeStacks, cloudformation:GetStackPolicy, cloudformation:GetTemplate, cloudfront:GetKeyGroup, cloudfront:GetMonitoringSubscription, cloudfront:ListKeyGroups, connect:ListEvaluationFormVersions, cur:DescribeReportDefinitions, cur:ListTagsForResource, datazone:GetDomainUnit, datazone:GetEnvironmentAction, datazone:GetEnvironmentBlueprintConfiguration, datazone:GetEnvironmentProfile, datazone:GetGroupProfile, datazone:GetSubscriptionTarget, datazone:GetUserProfile, datazone:ListDomainUnitsForParent, datazone:ListEntityOwners, datazone:ListEnvironmentActions, datazone:ListEnvironmentBlueprintConfigurations, datazone:ListEnvironmentProfiles, datazone:ListPolicyGrants, datazone:ListProjectMemberships, datazone:ListSubscriptionTargets, datazone:SearchGroupProfiles, datazone:SearchUserProfiles, docdb-elastic:GetCluster, docdb-elastic:ListClusters, docdb-elastic:ListTagsForResource, ec2:GetRouteServerAssociations, ec2:GetRouteServerPropagations, ec2:SearchTransitGatewayRoutes, fis:ListTagsForResource, frauddetector:GetListElements, frauddetector:GetListsMetadata, guardduty:GetThreatEntitySet, guardduty:GetTrustedEntitySet, guardduty:ListThreatEntitySets, guardduty:ListTrustedEntitySets, iotfleetwise:GetCampaign, iotfleetwise:ListCampaigns, iotsitewise:DescribeComputationModel, iotsitewise:DescribeDataset, iotsitewise:ListComputationModels, iotsitewise:ListDatasets, iotwireless:GetWirelessDeviceImportTask, iotwireless:ListWirelessDeviceImportTasks, kendra:ListDataSources, logs:DescribeQueryDefinitions, logs:GetIntegration, logs:ListIntegrations, mediaconnect:ListRouterOutputs, medialive:DescribeMultiplex, medialive:DescribeSdiSource, medialive:GetCloudWatchAlarmTemplate, medialive:GetCloudWatchAlarmTemplateGroup, medialive:GetEventBridgeRuleTemplate, medialive:GetEventBridgeRuleTemplateGroup, medialive:ListCloudWatchAlarmTemplateGroups, medialive:ListCloudWatchAlarmTemplates, medialive:ListEventBridgeRuleTemplateGroups, medialive:ListEventBridgeRuleTemplates, medialive:ListSdiSources, medialive:ListSignalMaps, networkmanager:GetConnectAttachment, networkmanager:GetCoreNetwork, networkmanager:GetCoreNetworkPolicy, networkmanager:GetDirectConnectGatewayAttachment, networkmanager:GetSiteToSiteVpnAttachment, networkmanager:ListAttachments, networkmanager:ListCoreNetworks, notifications:GetEventRule, notifications:ListEventRules, notifications:ListManagedNotificationChannelAssociations, notifications:ListNotificationHubs, notifications:ListOrganizationalUnits, refactor-spaces:GetApplication, refactor-spaces:GetRoute, refactor-spaces:ListRoutes, resource-explorer-2:GetDefaultView, route53resolver:GetOutpostResolver, route53resolver:ListOutpostResolvers, securityhub:DescribeOrganizationConfiguration, securityhub:GetAggregatorV2, securityhub:GetAutomationRuleV2, securityhub:GetConfigurationPolicyAssociation, securityhub:GetFindingAggregator, securityhub:ListAggregatorsV2, securityhub:ListAutomationRulesV2, securityhub:ListConfigurationPolicyAssociations, securityhub:ListFindingAggregators, sms-voice:DescribeConfigurationSets, sms-voice:DescribeKeywords, sms-voice:DescribeProtectConfigurations, sms-voice:GetProtectConfigurationCountryRuleSet, sms-voice:ListPoolOriginationIdentities, sms-voice:ListTagsForResource, workspaces-web:GetTrustStore, workspaces-web:GetTrustStoreCertificate, workspaces-web:GetUserAccessLoggingSettings, workspaces-web:ListTagsForResource. | This policy now supports additional permissions for recording configuration changes across numerous AWS services. | February 17, 2026 +AWS_ConfigRole – Added permissions: application-autoscaling:DescribeScheduledActions, appsync:GetApiAssociation, cloudformation:DescribeStacks, cloudformation:GetStackPolicy, cloudformation:GetTemplate, cloudfront:GetKeyGroup, cloudfront:GetMonitoringSubscription, cloudfront:ListKeyGroups, connect:ListEvaluationFormVersions, cur:DescribeReportDefinitions, cur:ListTagsForResource, datazone:GetDomainUnit, datazone:GetEnvironmentAction, datazone:GetEnvironmentBlueprintConfiguration, datazone:GetEnvironmentProfile, datazone:GetGroupProfile, datazone:GetSubscriptionTarget, datazone:GetUserProfile, datazone:ListDomainUnitsForParent, datazone:ListEntityOwners, datazone:ListEnvironmentActions, datazone:ListEnvironmentBlueprintConfigurations, datazone:ListEnvironmentProfiles, datazone:ListPolicyGrants, datazone:ListProjectMemberships, datazone:ListSubscriptionTargets, datazone:SearchGroupProfiles, datazone:SearchUserProfiles, docdb-elastic:GetCluster, docdb-elastic:ListClusters, docdb-elastic:ListTagsForResource, ec2:GetRouteServerAssociations, ec2:GetRouteServerPropagations, ec2:SearchTransitGatewayRoutes, fis:ListTagsForResource, frauddetector:GetListElements, frauddetector:GetListsMetadata, guardduty:GetThreatEntitySet, guardduty:GetTrustedEntitySet, guardduty:ListThreatEntitySets, guardduty:ListTrustedEntitySets, iotfleetwise:GetCampaign, iotfleetwise:ListCampaigns, iotsitewise:DescribeComputationModel, iotsitewise:DescribeDataset, iotsitewise:ListComputationModels, iotsitewise:ListDatasets, iotwireless:GetWirelessDeviceImportTask, iotwireless:ListWirelessDeviceImportTasks, kendra:ListDataSources, logs:DescribeQueryDefinitions, logs:GetIntegration, logs:ListIntegrations, mediaconnect:ListRouterOutputs, medialive:DescribeMultiplex, medialive:DescribeSdiSource, medialive:GetCloudWatchAlarmTemplate, medialive:GetCloudWatchAlarmTemplateGroup, medialive:GetEventBridgeRuleTemplate, medialive:GetEventBridgeRuleTemplateGroup, medialive:ListCloudWatchAlarmTemplateGroups, medialive:ListCloudWatchAlarmTemplates, medialive:ListEventBridgeRuleTemplateGroups, medialive:ListEventBridgeRuleTemplates, medialive:ListSdiSources, medialive:ListSignalMaps, networkmanager:GetConnectAttachment, networkmanager:GetCoreNetwork, networkmanager:GetCoreNetworkPolicy, networkmanager:GetDirectConnectGatewayAttachment, networkmanager:GetSiteToSiteVpnAttachment, networkmanager:ListAttachments, networkmanager:ListCoreNetworks, notifications:GetEventRule, notifications:ListEventRules, notifications:ListManagedNotificationChannelAssociations, notifications:ListNotificationHubs, notifications:ListOrganizationalUnits, refactor-spaces:GetApplication, refactor-spaces:GetRoute, refactor-spaces:ListRoutes, resource-explorer-2:GetDefaultView, route53resolver:GetOutpostResolver, route53resolver:ListOutpostResolvers, securityhub:DescribeOrganizationConfiguration, securityhub:GetAggregatorV2, securityhub:GetAutomationRuleV2, securityhub:GetConfigurationPolicyAssociation, securityhub:GetFindingAggregator, securityhub:ListAggregatorsV2, securityhub:ListAutomationRulesV2, securityhub:ListConfigurationPolicyAssociations, securityhub:ListFindingAggregators, sms-voice:DescribeConfigurationSets, sms-voice:DescribeKeywords, sms-voice:DescribeProtectConfigurations, sms-voice:GetProtectConfigurationCountryRuleSet, sms-voice:ListPoolOriginationIdentities, sms-voice:ListTagsForResource, workspaces-web:GetTrustStore, workspaces-web:GetTrustStoreCertificate, workspaces-web:GetUserAccessLoggingSettings, workspaces-web:ListTagsForResource. | This policy now supports additional permissions for recording configuration changes across numerous AWS services. | February 17, 2026