AWS devopsagent medium security documentation change
Summary
Removed the entire AIDevOpsAgentAccessPolicy IAM policy documentation that granted extensive read permissions across multiple AWS services
Security assessment
The removed policy contained broad read access to security-sensitive services like IAM, KMS, GuardDuty, and SecurityHub. Removing this policy documentation suggests a security improvement through reduced permissions, potentially addressing overprivileged access. The change impacts security by limiting the agent's access surface area.
Diff
diff --git a/devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md b/devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md index 0d2ccc648..cc3b2f69b 100644 --- a//devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md +++ b//devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md @@ -245,867 +244,0 @@ This service-linked role provides AWS DevOps Agent ability to provide usage info -### AIDevOpsAgentAccessPolicy - -Provides permissions required by the AWS DevOps Agent to perform analysis on customer AWS resources during investigations. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AIOPSServiceAccess", - "Effect": "Allow", - "Action": [ - "access-analyzer:GetAnalyzer", - "access-analyzer:List*", - "acm-pca:Describe*", - "acm-pca:GetCertificate", - "acm-pca:GetCertificateAuthorityCertificate", - "acm-pca:GetCertificateAuthorityCsr", - "acm-pca:List*", - "acm:DescribeCertificate", - "acm:GetAccountConfiguration", - "aidevops:GetKnowledgeItem", - "aidevops:ListKnowledgeItems", - "airflow:List*", - "amplify:GetApp", - "amplify:GetBranch", - "amplify:GetDomainAssociation", - "amplify:List*", - "aoss:BatchGetCollection", - "aoss:BatchGetLifecyclePolicy", - "aoss:BatchGetVpcEndpoint", - "aoss:GetAccessPolicy", - "aoss:GetSecurityConfig", - "aoss:GetSecurityPolicy", - "aoss:List*", - "appconfig:GetApplication", - "appconfig:GetConfigurationProfile", - "appconfig:GetEnvironment", - "appconfig:GetHostedConfigurationVersion", - "appconfig:List*", - "appflow:Describe*", - "appflow:List*", - "application-autoscaling:Describe*", - "application-signals:BatchGetServiceLevelObjectiveBudgetReport", - "application-signals:GetService", - "application-signals:GetServiceLevelObjective", - "application-signals:List*", - "applicationinsights:Describe*", - "applicationinsights:List*", - "apprunner:Describe*", - "apprunner:List*", - "appstream:Describe*", - "appstream:List*", - "appsync:GetApiAssociation", - "appsync:GetDataSource", - "appsync:GetDomainName", - "appsync:GetFunction", - "appsync:GetGraphqlApi", - "appsync:GetGraphqlApiEnvironmentVariables", - "appsync:GetIntrospectionSchema", - "appsync:GetResolver", - "appsync:GetSourceApiAssociation", - "appsync:List*", - "aps:Describe*", - "aps:List*", - "arc-zonal-shift:GetManagedResource", - "arc-zonal-shift:List*", - "athena:GetCapacityAssignmentConfiguration", - "athena:GetCapacityReservation", - "athena:GetDataCatalog", - "athena:GetNamedQuery", - "athena:GetPreparedStatement", - "athena:GetWorkGroup", - "athena:List*", - "auditmanager:GetAssessment", - "auditmanager:List*", - "autoscaling:Describe*", - "backup-gateway:GetHypervisor", - "backup-gateway:List*", - "backup:Describe*", - "backup:GetBackupPlan", - "backup:GetBackupSelection", - "backup:GetBackupVaultAccessPolicy", - "backup:GetBackupVaultNotifications", - "backup:GetRestoreTestingPlan", - "backup:GetRestoreTestingSelection", - "backup:List*", - "batch:DescribeComputeEnvironments", - "batch:DescribeJobQueues", - "batch:DescribeSchedulingPolicies", - "batch:List*", - "bedrock:GetAgent", - "bedrock:GetAgentActionGroup", - "bedrock:GetAgentAlias", - "bedrock:GetAgentKnowledgeBase", - "bedrock:GetDataSource", - "bedrock:GetGuardrail", - "bedrock:GetKnowledgeBase", - "bedrock:List*", - "budgets:Describe*", - "budgets:List*", - "ce:Describe*", - "ce:GetAnomalyMonitors", - "ce:GetAnomalySubscriptions", - "ce:List*", - "chatbot:Describe*", - "chatbot:GetMicrosoftTeamsChannelConfiguration", - "chatbot:List*", - "cleanrooms-ml:GetTrainingDataset", - "cleanrooms-ml:List*", - "cleanrooms:GetAnalysisTemplate", - "cleanrooms:GetCollaboration", - "cleanrooms:GetConfiguredTable", - "cleanrooms:GetConfiguredTableAnalysisRule", - "cleanrooms:GetConfiguredTableAssociation", - "cleanrooms:GetMembership", - "cleanrooms:List*", - "cloudformation:Describe*", - "cloudformation:GetResource", - "cloudformation:GetStackPolicy", - "cloudformation:GetTemplate", - "cloudformation:List*", - "cloudfront:Describe*", - "cloudfront:GetCachePolicy", - "cloudfront:GetCloudFrontOriginAccessIdentity", - "cloudfront:GetContinuousDeploymentPolicy", - "cloudfront:GetDistribution", - "cloudfront:GetDistributionConfig", - "cloudfront:GetFunction", - "cloudfront:GetKeyGroup", - "cloudfront:GetMonitoringSubscription", - "cloudfront:GetOriginAccessControl", - "cloudfront:GetOriginRequestPolicy", - "cloudfront:GetPublicKey", - "cloudfront:GetRealtimeLogConfig", - "cloudfront:GetResponseHeadersPolicy", - "cloudfront:List*", - "cloudtrail:Describe*", - "cloudtrail:GetChannel", - "cloudtrail:GetEventConfiguration", - "cloudtrail:GetEventDataStore", - "cloudtrail:GetEventSelectors", - "cloudtrail:GetInsightSelectors", - "cloudtrail:GetQueryResults", - "cloudtrail:GetResourcePolicy", - "cloudtrail:GetTrail", - "cloudtrail:GetTrailStatus", - "cloudtrail:List*", - "cloudtrail:LookupEvents", - "cloudtrail:StartQuery", - "cloudwatch:Describe*", - "cloudwatch:GenerateQuery", - "cloudwatch:GetDashboard", - "cloudwatch:GetInsightRuleReport", - "cloudwatch:GetMetricData", - "cloudwatch:GetMetricStatistics", - "cloudwatch:GetMetricStream", - "cloudwatch:GetService", - "cloudwatch:GetServiceLevelObjective", - "cloudwatch:List*", - "codeartifact:Describe*", - "codeartifact:GetDomainPermissionsPolicy", - "codeartifact:GetRepositoryPermissionsPolicy", - "codeartifact:List*", - "codebuild:BatchGetFleets", - "codebuild:List*", - "codecommit:GetRepository", - "codecommit:GetRepositoryTriggers", - "codedeploy:BatchGetDeployments", - "codedeploy:BatchGetDeploymentTargets", - "codedeploy:GetApplication", - "codedeploy:GetDeploymentConfig", - "codedeploy:GetDeploymentTarget", - "codedeploy:List*", - "codeguru-profiler:Describe*", - "codeguru-profiler:GetNotificationConfiguration", - "codeguru-profiler:GetPolicy", - "codeguru-profiler:List*", - "codeguru-reviewer:Describe*", - "codeguru-reviewer:List*", - "codepipeline:GetPipeline", - "codepipeline:GetPipelineState", - "codepipeline:List*", - "codestar-connections:GetConnection", - "codestar-connections:GetRepositoryLink", - "codestar-connections:GetSyncConfiguration", - "codestar-connections:List*", - "codestar-notifications:Describe*", - "codestar-notifications:List*", - "cognito-identity:DescribeIdentityPool", - "cognito-identity:GetIdentityPoolRoles", - "cognito-identity:ListIdentityPools", - "cognito-identity:ListTagsForResource", - "cognito-idp:AdminListGroupsForUser", - "cognito-idp:DescribeIdentityProvider",