AWS drs documentation change
Summary
Enhanced documentation about IAM permissions required for tagging resources during creation, adding specific action examples and clarifying that users need explicit drs:TagResource permissions when tags are specified in creation actions.
Security assessment
This change improves documentation about IAM security controls for tagging operations. It clarifies the specific API actions (drs:CreateSourceServerForDrs, drs:CreateRecoveryInstanceForDrs, drs:TagResource) and the authorization flow when tagging during resource creation. While this adds security documentation about proper IAM policy configuration, there is no evidence that it addresses a specific security vulnerability or incident. The typo fix from 'recover instance' to 'recovery instance' is also included.
Diff
diff --git a/drs/latest/userguide/supported-iam-actions-tagging.md b/drs/latest/userguide/supported-iam-actions-tagging.md index 3f741511f..893d76def 100644 --- a//drs/latest/userguide/supported-iam-actions-tagging.md +++ b//drs/latest/userguide/supported-iam-actions-tagging.md @@ -9 +9,12 @@ Some resource-creating Amazon DRS API actions allow you to specify tags when you -To allow users to tag resources on creation, they must have permissions to use the action that creates the resource, such as `drs:CreateSourceServerForDrs` for source server or `drs:CreateRecoveryInstanceForDrs` for Recovery instances. If tags are specified in the resource-creating action, Amazon performs additional authorization on the `drs:TagResource` action to verify that users have permissions to create tags. Therefore, users must also have explicit permissions to use the `drs:TagResource` action. +To allow users to tag resources on creation, they must have permissions to use the action that creates the resource, such as: + + * `drs:CreateSourceServerForDrs` – for creating a source server + + * `drs:CreateRecoveryInstanceForDrs` – for creating a Recovery instance + + * `drs:TagResource` – if tags are specified in the resource-creating action + + + + +If tags are specified in the resource-creating action, Amazon performs additional authorization on the `drs:TagResource` action to verify that users have permissions to create tags. Therefore, users must also have explicit permissions to use the `drs:TagResource` action. @@ -13 +24 @@ In the IAM policy definition for the `drs:TagResource` action, use the Condition -The following example demonstrates a policy that allows an agent installer to create a source server or recover instance and apply any tags to the resource on creation. The installer is not permitted to tag any existing resources (it cannot call the `drs:TagResource` action directly). +The following example demonstrates a policy that allows an agent installer to create a source server or recovery instance and apply any tags to the resource on creation. The installer is not permitted to tag any existing resources (it cannot call the `drs:TagResource` action directly).