AWS res documentation change
Summary
Updated IAM role preparation steps with detailed policy and role creation instructions, added images, and expanded supported Windows OS list.
Security assessment
The changes provide more detailed steps for creating an IAM role and policy, which are security best practices, but there is no indication of a security vulnerability being addressed. The changes are primarily documentation improvements and clarifications.
Diff
diff --git a/res/archive/release-minus-4/ug/res-ready-ami.md b/res/archive/release-minus-4/ug/res-ready-ami.md index 94c8c070d..3baf0f5fa 100644 --- a//res/archive/release-minus-4/ug/res-ready-ami.md +++ b//res/archive/release-minus-4/ug/res-ready-ami.md @@ -5 +5 @@ -Prepare IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES +Prepare an IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES @@ -15 +15 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ - * Prepare IAM role to access RES environment + * Prepare an IAM role to access RES environment @@ -32 +32 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ -## Prepare IAM role to access RES environment +## Prepare an IAM role to access RES environment @@ -38 +38 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Trusted relationships include the Amazon EC2 service. + * Trusted relationships that include the Amazon EC2 service. @@ -42 +42 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. + * A custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. @@ -49,6 +49 @@ To access the RES environment service from EC2 Image Builder, you must create or -**Trusted relationship entity:** - -JSON - - -**** + 1. Start by creating a new policy that will be attached to your role: **IAM** -> **Policies** -> **Create policy** @@ -55,0 +51 @@ JSON + 2. Select **JSON** from the policy editor. @@ -57,14 +53 @@ JSON - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - + 3. Copy and paste the policy shown here into the editor, replacing `us-east-1` with your desired AWS Region, `111122223333` with your AWS account ID, and `{RES-EnvironmentName}` with your RES EnvironmentName where applicable. @@ -112,0 +95,41 @@ JSON + 4. Choose **Next** and provide a name and optional description to complete the policy creation. + + 5. To create the role, start by going to **IAM** -> **Roles** -> **Create role**. + + 6. Under **Trusted Entity Type** , select **"AWS service"**. + + 7. Select **EC2** in the **Service or use case** drop down. + + 8. In the **Use case** section, select **EC2** , then choose **Next**. + + 9. Search for and then select the name of the policy you previously created. + + 10. Choose **Next** and provide a name and optional description to complete the role creation. + + 11. Select your new role and verify that the Trust relationship matches the following: + +**Trusted relationship entity:** + +JSON + + +**** + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + }, + "Action": "sts:AssumeRole" + } + ] + } + + + + + @@ -288 +311,3 @@ RES supports the following image operating systems: - * Windows 2019, 2022 (x86) + * Windows Server 2019, 2022 (x86) + + * Windows 10, 11 (x86) @@ -323,0 +349,2 @@ For Linux environments, you must add these components in order with the `aws-cli + + @@ -343,0 +371,2 @@ For Linux environments, you must add these components in order with the `aws-cli + + @@ -362 +391 @@ You can use infrastructure configurations to specify the Amazon EC2 infrastructu - 1. For **IAM role** , enter the role you previously configured in Prepare IAM role to access RES environment. + 1. For **IAM role** , enter the role you previously configured in Prepare an IAM role to access RES environment.