AWS amazondynamodb medium security documentation change
Summary
Added a markdown link and removed 'dynamodb:ListShards' from required actions in cross-account DynamoDB Streams policy example
Security assessment
The change removes 'dynamodb:ListShards' from the list of required DynamoDB Stream actions in a cross-account access policy example. This could indicate a security improvement by reducing unnecessary permissions (principle of least privilege) or correcting a documentation error that previously recommended excessive permissions. Removing unnecessary IAM actions reduces the attack surface and potential privilege escalation risks.
Diff
diff --git a/amazondynamodb/latest/developerguide/rbac-cross-account-access.md b/amazondynamodb/latest/developerguide/rbac-cross-account-access.md index d33b76cf0..045a7969b 100644 --- a//amazondynamodb/latest/developerguide/rbac-cross-account-access.md +++ b//amazondynamodb/latest/developerguide/rbac-cross-account-access.md @@ -0,0 +1,2 @@ +[View a markdown version of this page](rbac-cross-account-access.md) + @@ -53 +55 @@ The requests will be logged in the CloudTrail logs of both the owner and the req - 4. Create a policy that specifies the Lambda execution role in account A as the principal and grant the required DynamoDB Stream actions. Make sure to include the actions `dynamodb:DescribeStream`, `dynamodb:GetRecords`, `dynamodb:GetShardIterator`, and `dynamodb:ListShards`. For more information on example resource policies for DynamoDB Streams, see [ DynamoDB resource-based policy examples](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-examples.html). + 4. Create a policy that specifies the Lambda execution role in account A as the principal, and grant the required DynamoDB Streams actions. Make sure to include the actions `dynamodb:DescribeStream`, `dynamodb:GetRecords`, and `dynamodb:GetShardIterator`. For more information about example resource policies for DynamoDB Streams, see [ DynamoDB resource-based policy examples](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-examples.html).