AWS IAM medium security documentation change
Summary
Added duplicate 'Amazon' in example and added important clarification about session policies not supporting incomplete ARNs
Security assessment
The change adds critical security documentation about session policies not supporting incomplete ARNs, which could lead to security misconfigurations if not understood. The documentation now explicitly states that using incomplete ARNs in session policies will result in a MalformedPolicyDocumentException error, preventing potential privilege escalation or unintended access through temporary credentials. This addresses a security-relevant configuration detail that could impact the security of AssumeRole, AssumeRoleWithWebIdentity, and AssumeRoleWithSAML operations.
Diff
diff --git a/IAM/latest/UserGuide/reference_identifiers.md b/IAM/latest/UserGuide/reference_identifiers.md index bddab93c6..4f8c86c89 100644 --- a//IAM/latest/UserGuide/reference_identifiers.md +++ b//IAM/latest/UserGuide/reference_identifiers.md @@ -277 +277 @@ Don't use a wildcard in the `user/`, `group/`, or `policy/` part of the ARN. For -When you specify an incomplete ARN (one with fewer than the standard six fields) in an identity-based policy, AWS automatically completes the ARN by adding wildcard characters (*) to all missing fields. For example, specifying `arn:aws:sqs` is equivalent to `arn:aws:sqs:*:*:*`, which grants access to all Amazon SQS resources across all regions and accounts. +When you specify an incomplete ARN (one with fewer than the standard six fields) in an identity-based policy, AWS automatically completes the ARN by adding wildcard characters (*) to all missing fields. For example, specifying `arn:aws:sqs` is equivalent to `arn:aws:sqs:*:*:*`, which grants access to all Amazon Amazon SQS resources across all regions and accounts. However, session policies passed to AWS STS AssumeRole, AssumeRoleWithWebIdentity, and AssumeRoleWithSAML requests, do not support incomplete ARNs. Using an incomplete ARN in a session policy will result in a `MalformedPolicyDocumentException` error.