AWS IAM medium security documentation change
Summary
Fixed typo ('deliminated' to 'delimited'), added duplicate 'Amazon' in example, and added important clarification about session policies not supporting incomplete ARNs
Security assessment
The change adds critical security documentation about session policies not supporting incomplete ARNs, which could lead to security misconfigurations if not understood. The documentation now explicitly states that using incomplete ARNs in session policies will result in a MalformedPolicyDocumentException error, preventing potential privilege escalation or unintended access through temporary credentials. This addresses a security-relevant configuration detail that could impact the security of AssumeRole operations.
Diff
diff --git a/IAM/latest/UserGuide/reference-arns.md b/IAM/latest/UserGuide/reference-arns.md index a24f19a8a..4be29fe5b 100644 --- a//IAM/latest/UserGuide/reference-arns.md +++ b//IAM/latest/UserGuide/reference-arns.md @@ -109 +109 @@ You can also use the `?` wildcard character to specify one character in an ARN. -You can also use wildcards in the different sections of an ARN, deliminated by a colon “`:`”. In the following example, two wildcards are used to match all Amazon Q applications and resources within the applications in all regions for account 123456789012: +You can also use wildcards in the different sections of an ARN, delimited by a colon “`:`”. In the following example, two wildcards are used to match all Amazon Q applications and resources within the applications in all regions for account 123456789012: @@ -133 +133 @@ You cannot use a wildcard in the portion of the ARN that specifics the resource -When you specify an incomplete ARN (one with fewer than the standard six fields) in an identity-based policy, AWS automatically completes the ARN by adding wildcard characters (*) to all missing fields. For example, specifying `arn:aws:sqs` is equivalent to `arn:aws:sqs:*:*:*`, which grants access to all Amazon SQS resources across all regions and accounts. +When you specify an incomplete ARN (one with fewer than the standard six fields) in an identity-based policy, AWS automatically completes the ARN by adding wildcard characters (*) to all missing fields. For example, specifying `arn:aws:sqs` is equivalent to `arn:aws:sqs:*:*:*`, which grants access to all Amazon Amazon SQS resources across all regions and accounts. However, session policies passed to AWS STS AssumeRole, AssumeRoleWithWebIdentity, and AssumeRoleWithSAML requests, do not support incomplete ARNs. Using an incomplete ARN in a session policy will result in a `MalformedPolicyDocumentException` error.