AWS amazondynamodb documentation change
Summary
Updated IAM and KMS policy examples in DynamoDB global tables security documentation by replacing placeholder account IDs (A, B, C) with realistic AWS account numbers (111122223333, 444455556666, 123456789012) and adding JSON formatting markers.
Security assessment
The changes improve the clarity and accuracy of security policy examples for cross-account replication scenarios, but there is no evidence of addressing a specific security vulnerability. The updates enhance documentation of security features (IAM policies, KMS policies) for secure global table configurations.
Diff
diff --git a/amazondynamodb/latest/developerguide/globaltables_MA_security.md b/amazondynamodb/latest/developerguide/globaltables_MA_security.md index d2cd969d1..ad3e8208e 100644 --- a//amazondynamodb/latest/developerguide/globaltables_MA_security.md +++ b//amazondynamodb/latest/developerguide/globaltables_MA_security.md @@ -112,0 +113,6 @@ To establish this setup: +JSON + + +**** + + @@ -125 +131 @@ To establish this setup: - "Resource": "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", + "Resource": "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", @@ -129 +135 @@ To establish this setup: - "aws:SourceAccount": [ "A", "B" ], + "aws:SourceAccount": [ "111122223333", "444455556666" ], @@ -131,2 +137,2 @@ To establish this setup: - "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB" + "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB" @@ -143,2 +149,2 @@ To establish this setup: - "Resource": "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "Principal": {"AWS": ["B"]} + "Resource": "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "Principal": {"AWS": ["444455556666"]} @@ -149,0 +156,6 @@ To establish this setup: +JSON + + +**** + + @@ -162 +174 @@ To establish this setup: - "Resource": "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB", + "Resource": "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB", @@ -166 +178 @@ To establish this setup: - "aws:SourceAccount": [ "A", "B" ], + "aws:SourceAccount": [ "111122223333", "444455556666" ], @@ -168,2 +180,2 @@ To establish this setup: - "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB" + "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB" @@ -183,0 +197,6 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, +JSON + + +**** + + @@ -196 +215 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "Resource": "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", + "Resource": "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", @@ -200 +219 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "aws:SourceAccount": [ "A", "B", "C" ], + "aws:SourceAccount": [ "111122223333", "444455556666", "123456789012" ], @@ -202,3 +221,3 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB", - "arn:aws:dynamodb:us-east-1:C:table/ReplicaC" + "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB", + "arn:aws:dynamodb:us-east-1:123456789012:table/ReplicaC" @@ -215,2 +234,2 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "Resource": "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "Principal": { "AWS": [ "B", "C" ] } + "Resource": "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "Principal": { "AWS": [ "444455556666", "123456789012" ] } @@ -226,0 +246,6 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, +JSON + + +**** + + @@ -239 +264 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "Resource": "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB", + "Resource": "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB", @@ -243 +268 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "aws:SourceAccount": [ "A", "B", "C" ], + "aws:SourceAccount": [ "111122223333", "444455556666", "123456789012" ], @@ -245,3 +270,3 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB", - "arn:aws:dynamodb:us-east-1:C:table/ReplicaC" + "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB", + "arn:aws:dynamodb:us-east-1:123456789012:table/ReplicaC" @@ -258,2 +283,2 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "Resource": "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB", - "Principal": { "AWS": [ "C" ] } + "Resource": "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB", + "Principal": { "AWS": [ "123456789012" ] } @@ -269,0 +295,6 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, +JSON + + +**** + + @@ -282 +313 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "Resource": "arn:aws:dynamodb:us-east-1:C:table/ReplicaC", + "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/ReplicaC", @@ -286 +317 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "aws:SourceAccount": [ "A", "B" ], + "aws:SourceAccount": [ "111122223333", "444455556666" ], @@ -288,2 +319,2 @@ In this setup, we have 3 replicas ReplicaA, ReplicaB, and ReplicaC in Account A, - "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB" + "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB" @@ -382,0 +414,6 @@ The AWS KMS policy allows DynamoDB to access both AWS KMS keys for replication b +JSON + + +**** + + @@ -395,0 +433 @@ The AWS KMS policy allows DynamoDB to access both AWS KMS keys for replication b + "Resource": "*", @@ -398 +436 @@ The AWS KMS policy allows DynamoDB to access both AWS KMS keys for replication b - "aws:SourceAccount": [ "A", "B" ], + "aws:SourceAccount": [ "111122223333", "444455556666" ], @@ -400,2 +438,2 @@ The AWS KMS policy allows DynamoDB to access both AWS KMS keys for replication b - "arn:aws:dynamodb:ap-east-1:A:table/ReplicaA", - "arn:aws:dynamodb:eu-south-1:B:table/ReplicaB" + "arn:aws:dynamodb:ap-east-1:111122223333:table/ReplicaA", + "arn:aws:dynamodb:eu-south-1:444455556666:table/ReplicaB"