AWS devopsagent documentation change
Summary
Major rewrite of AWS DevOps Agent CLI onboarding guide with updated structure, expanded regional availability, clarified prerequisites, updated IAM roles and policies, restructured onboarding steps, and added integration instructions
Security assessment
The changes update IAM policies and trust relationships but don't indicate a specific security vulnerability. Key security-related updates include: changing from custom inline policies to AWS managed policies (AIDevOpsAgentAccessPolicy, AIDevOpsOperatorAppAccessPolicy), updating trust policies to include region-specific ARNs and aws:SourceAccount conditions, adding sts:TagSession to operator app role, and changing cross-account trust from specific role to service principal (aidevops.amazonaws.com). These appear to be routine security improvements and best practice updates rather than fixes for a specific security issue.
Diff
diff --git a/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-cli-onboarding-guide.md b/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-cli-onboarding-guide.md index 3e0a61748..dd0e4de36 100644 --- a//devopsagent/latest/userguide/getting-started-with-aws-devops-agent-cli-onboarding-guide.md +++ b//devopsagent/latest/userguide/getting-started-with-aws-devops-agent-cli-onboarding-guide.md @@ -5 +5 @@ -OverviewPrerequisitesSetup AWS CLI for DevOps AgentIAM Roles SetupOnboarding StepsVerificationNotes +OverviewPrerequisitesIAM roles setupOnboarding stepsVerificationNext stepsNotes @@ -7 +7 @@ OverviewPrerequisitesSetup AWS CLI for DevOps AgentIAM Roles SetupOnboarding Ste -# CLI onboarding guide +# AWS DevOps Agent CLI onboarding guide @@ -11 +11 @@ OverviewPrerequisitesSetup AWS CLI for DevOps AgentIAM Roles SetupOnboarding Ste -AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guide walks you through setting up AWS DevOps Agent in the **us-east-1** region. +With AWS DevOps Agent, you can monitor and manage your AWS infrastructure. This guide walks you through setting up AWS DevOps Agent by using the AWS Command Line Interface (AWS CLI). You create IAM roles, set up an agent space, and associate your AWS account. You also enable the operator app and optionally connect third-party integrations. This guide takes approximately 20 minutes to complete. @@ -13,3 +13 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid -###### Note - - __AWS DevOps Agent is in preview. The instructions on this page may change before general availability (GA) +AWS DevOps Agent is available in six AWS Regions: US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), and Europe (Ireland). For more information about supported Regions, see [Supported Regions](./about-aws-devops-agent-supported-regions.html). @@ -19,5 +17 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid - * AWS CLI installed and configured - - * Authenticated to your AWS monitoring account - - * AWS DevOps Agent is available in us-east-1 +Before you begin, make sure that you have the following: @@ -24,0 +19 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid + * AWS CLI version 2 installed and configured @@ -25,0 +21 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid + * Authentication to your AWS monitoring account @@ -26,0 +23 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid + * Permissions to create AWS Identity and Access Management (IAM) roles and attach policies @@ -28 +25 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid -## Setup AWS CLI for DevOps Agent + * An AWS account to use as the monitoring account @@ -30 +27 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid -### Download the Service Model + * Familiarity with the AWS CLI and JSON syntax @@ -32 +28,0 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure. This guid -Download the AWS DevOps Agent model file: @@ -35,2 +30,0 @@ Download the AWS DevOps Agent model file: - # Download from: https://d1co8nkiwcta1g.cloudfront.net/devopsagent.json - # Save as: devopsagent.json @@ -38 +32 @@ Download the AWS DevOps Agent model file: -### Patch AWS CLI +Throughout this guide, replace the following placeholder values with your own: @@ -40 +34 @@ Download the AWS DevOps Agent model file: -Add the DevOps Agent service to your AWS CLI: + * `<MONITORING_ACCOUNT_ID>` — Your 12-digit AWS account ID for the monitoring (primary) account @@ -41,0 +36 @@ Add the DevOps Agent service to your AWS CLI: + * `<EXTERNAL_ACCOUNT_ID>` — The 12-digit AWS account ID of the secondary account to monitor (used in step 4) @@ -43 +38 @@ Add the DevOps Agent service to your AWS CLI: - aws configure add-model --service-model "file://${PWD}/devopsagent.json" --service-name devopsagent + * `<REGION>` — The AWS Region code for your agent space (for example, `us-east-1` or `eu-central-1`) @@ -44,0 +40 @@ Add the DevOps Agent service to your AWS CLI: + * `<AGENT_SPACE_ID>` — The agent space identifier that is returned by the `create-agent-space` command @@ -46 +41,0 @@ Add the DevOps Agent service to your AWS CLI: -Test the installation: @@ -49 +43,0 @@ Test the installation: - aws devopsagent help @@ -50,0 +45 @@ Test the installation: +## IAM roles setup @@ -52 +47 @@ Test the installation: -## IAM Roles Setup +### 1\. Create the DevOps Agent space role @@ -54,3 +49 @@ Test the installation: -### 1\. Create DevOps Agent Space Role - -Create the AWS Identity and Access Management (IAM) trust policy: +Create the IAM trust policy by running the following command: @@ -71 +64 @@ Create the AWS Identity and Access Management (IAM) trust policy: - "aws:SourceAccount": "<ACCOUNT_ID>" + "aws:SourceAccount": "<MONITORING_ACCOUNT_ID>" @@ -74 +67 @@ Create the AWS Identity and Access Management (IAM) trust policy: - "aws:SourceArn": "arn:aws:aidevops:us-east-1:<ACCOUNT_ID>:agentspace/*" + "aws:SourceArn": "arn:aws:aidevops:<REGION>:<MONITORING_ACCOUNT_ID>:agentspace/*" @@ -87 +80 @@ Create the IAM role: - --region us-east-1 \ + --region <REGION> \ @@ -91 +84,4 @@ Create the IAM role: - # Save the role ARN + +Save the role ARN by running the following command: + + @@ -100 +96 @@ Attach the AWS managed policy: - --policy-arn arn:aws:iam::aws:policy/AIOpsAssistantPolicy + --policy-arn arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy @@ -103 +99 @@ Attach the AWS managed policy: -Create and attach additional inline policy: +Create and attach an inline policy to allow creation of the Resource Explorer service-linked role: @@ -106 +102 @@ Create and attach additional inline policy: - cat > devops-agentspace-inline-policy.json << 'EOF' + cat > devops-agentspace-additional-policy.json << 'EOF' @@ -111 +107 @@ Create and attach additional inline policy: - "Sid": "AllowAwsSupportActions", + "Sid": "AllowCreateServiceLinkedRoles", @@ -114,2 +110 @@ Create and attach additional inline policy: - "support:CreateCase", - "support:DescribeCases" + "iam:CreateServiceLinkedRole" @@ -118,16 +113 @@ Create and attach additional inline policy: - "*" - ] - }, - { - "Sid": "AllowExpandedAIOpsAssistantPolicy", - "Effect": "Allow", - "Action": [ - "aidevops:GetKnowledgeItem", - "aidevops:ListKnowledgeItems", - "eks:AccessKubernetesApi", - "synthetics:GetCanaryRuns", - "route53:GetHealthCheckStatus", - "resource-explorer-2:Search" - ], - "Resource": [ - "*" + "arn:aws:iam::<MONITORING_ACCOUNT_ID>:role/aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer" @@ -142,2 +122,2 @@ Create and attach additional inline policy: - --policy-name AllowExpandedAIOpsAssistantPolicy \ - --policy-document file://devops-agentspace-inline-policy.json + --policy-name AllowCreateServiceLinkedRoles \ + --policy-document file://devops-agentspace-additional-policy.json @@ -146 +126 @@ Create and attach additional inline policy: -### 2\. Create Operator App IAM Role +### 2\. Create the operator app IAM role @@ -148 +128 @@ Create and attach additional inline policy: -Create the IAM trust policy: +Create the IAM trust policy by running the following command: @@ -160 +140,4 @@ Create the IAM trust policy: - "Action": "sts:AssumeRole", + "Action": [ + "sts:AssumeRole", + "sts:TagSession" + ], @@ -163 +146 @@ Create the IAM trust policy: - "aws:SourceAccount": "<ACCOUNT_ID>" + "aws:SourceAccount": "<MONITORING_ACCOUNT_ID>" @@ -166 +149 @@ Create the IAM trust policy: - "aws:SourceArn": "arn:aws:aidevops:us-east-1:<ACCOUNT_ID>:agentspace/*" + "aws:SourceArn": "arn:aws:aidevops:<REGION>:<MONITORING_ACCOUNT_ID>:agentspace/*" @@ -181 +164 @@ Create the IAM role: - --region us-east-1 + --region <REGION> @@ -183,2 +165,0 @@ Create the IAM role: - # Save the role ARN - aws iam get-role --role-name DevOpsAgentRole-WebappAdmin --query 'Role.Arn' --output text @@ -185,0 +167 @@ Create the IAM role: +Save the role ARN by running the following command: @@ -187 +168,0 @@ Create the IAM role: -Create and attach the operator app inline policy: @@ -188,0 +170 @@ Create and attach the operator app inline policy: + aws iam get-role --role-name DevOpsAgentRole-WebappAdmin --query 'Role.Arn' --output text @@ -190,51 +171,0 @@ Create and attach the operator app inline policy: - cat > devops-operator-inline-policy.json << 'EOF' - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowBasicOperatorActions", - "Effect": "Allow", - "Action": [ - "aidevops:GetAgentSpace", - "aidevops:GetAssociation", - "aidevops:ListAssociations", - "aidevops:CreateBacklogTask", - "aidevops:GetBacklogTask", - "aidevops:UpdateBacklogTask", - "aidevops:ListBacklogTasks", - "aidevops:ListChildExecutions", - "aidevops:ListJournalRecords", - "aidevops:DiscoverTopology", - "aidevops:InvokeAgent", - "aidevops:ListGoals", - "aidevops:ListRecommendations", - "aidevops:ListExecutions", - "aidevops:GetRecommendation", - "aidevops:UpdateRecommendation", - "aidevops:CreateKnowledgeItem", - "aidevops:ListKnowledgeItems", - "aidevops:GetKnowledgeItem", - "aidevops:UpdateKnowledgeItem", - "aidevops:ListPendingMessages", - "aidevops:InitiateChatForCase", - "aidevops:EndChatForCase", - "aidevops:DescribeSupportLevel", - "aidevops:ListChats", - "aidevops:CreateChat", - "aidevops:SendMessage" - ], - "Resource": "arn:aws:aidevops:us-east-1:<ACCOUNT_ID>:agentspace/*" - }, - { - "Sid": "AllowSupportOperatorActions", - "Effect": "Allow", - "Action": [ - "support:DescribeCases", - "support:InitiateChatForCase", - "support:DescribeSupportLevel" - ],