AWS config documentation change
Summary
Added new permissions to AWS Config managed policies (AWSConfigServiceRolePolicy and AWS_ConfigRole) for recording configuration changes across multiple AWS services.
Security assessment
The change expands the permissions of AWS Config service roles to include numerous new read/list actions across various AWS services (e.g., auditmanager, bedrock, s3express, sagemaker). This enhances the service's ability to monitor and record configuration changes for compliance and security auditing purposes. There is no evidence this addresses a specific security vulnerability; it is a routine update to support new services and features.
Diff
diff --git a/config/latest/developerguide/security-iam-awsmanpol.md b/config/latest/developerguide/security-iam-awsmanpol.md index abe048820..3d2b69099 100644 --- a//config/latest/developerguide/security-iam-awsmanpol.md +++ b//config/latest/developerguide/security-iam-awsmanpol.md @@ -181,0 +182,2 @@ Change | Description | Date +AWSConfigServiceRolePolicy – Added permissions: auditmanager:GetAssessmentFramework, auditmanager:GetControl, auditmanager:ListAssessmentFrameworks, auditmanager:ListControls, bcm-dashboards:GetDashboard, bcm-dashboards:ListDashboards, bcm-dashboards:ListTagsForResource, bedrock:GetEvaluationJob, bedrock:ListEvaluationJobs, bedrock-agentcore:GetEvaluator, bedrock-agentcore:GetOnlineEvaluationConfig, bedrock-agentcore:GetPolicyEngine, bedrock-agentcore:ListEvaluators, bedrock-agentcore:ListOnlineEvaluationConfigs, bedrock-agentcore:ListPolicyEngines, chime:DescribeAppInstance, chime:ListAppInstances, chime:ListTagsForResource, dms:ListInstanceProfiles, emr-containers:DescribeManagedEndpoint, emr-containers:ListTagsForResource, gameliftstreams:GetApplication, gameliftstreams:GetStreamGroup, gameliftstreams:ListApplications, gameliftstreams:ListStreamGroups, gameliftstreams:ListTagsForResource, globalaccelerator:DescribeAcceleratorAttributes, glue:GetCatalog, glue:GetCatalogs, glue:GetSession, glue:ListSessions, lambda:ListCapacityProviders, medialive:DescribeNode, medialive:ListNodes, mediapackagev2:GetChannelPolicy, mediapackagev2:GetOriginEndpointPolicy, outposts:GetSite, outposts:ListSites, qbusiness:GetPolicy, redshift:DescribeDataShares, rtbfabric:GetInboundExternalLink, rtbfabric:GetLink, rtbfabric:GetOutboundExternalLink, rtbfabric:GetRequesterGateway, rtbfabric:GetResponderGateway, rtbfabric:ListLinks, rtbfabric:ListRequesterGateways, rtbfabric:ListResponderGateways, rtbfabric:ListTagsForResource, s3express:GetAccessPoint, s3express:GetAccessPointPolicy, s3express:GetAccessPointScope, s3express:ListAccessPointsForDirectoryBuckets, s3express:ListTagsForResource, s3vectors:GetVectorBucket, s3vectors:GetVectorBucketPolicy, s3vectors:ListTagsForResource, s3vectors:ListVectorBuckets, sagemaker:DescribeAutoMLJobV2, sagemaker:DescribeHyperParameterTuningJob, sagemaker:DescribePartnerApp, sagemaker:ListAutoMLJobs, sagemaker:ListHyperParameterTuningJobs, sagemaker:ListPartnerApps, servicecatalog:DescribeTagOption, servicecatalog:ListTagOptions, ssm-contacts:GetRotation, ssm-contacts:ListRotations, ssm-guiconnect:GetConnectionRecordingPreferences, sso:GetPermissionsBoundaryForPermissionSet, sso:ListCustomerManagedPolicyReferencesInPermissionSet, textract:GetAdapter, textract:ListAdapters, textract:ListTagsForResource, transfer:DescribeWebApp, transfer:DescribeWebAppCustomization, transfer:ListWebApps, wisdom:GetAIGuardrail, wisdom:ListAIGuardrails. | This policy now supports additional permissions for recording configuration changes across numerous AWS services. | March 10, 2026 +AWS_ConfigRole – Added permissions: auditmanager:GetAssessmentFramework, auditmanager:GetControl, auditmanager:ListAssessmentFrameworks, auditmanager:ListControls, bcm-dashboards:GetDashboard, bcm-dashboards:ListDashboards, bcm-dashboards:ListTagsForResource, bedrock:GetEvaluationJob, bedrock:ListEvaluationJobs, bedrock-agentcore:GetEvaluator, bedrock-agentcore:GetOnlineEvaluationConfig, bedrock-agentcore:GetPolicyEngine, bedrock-agentcore:ListEvaluators, bedrock-agentcore:ListOnlineEvaluationConfigs, bedrock-agentcore:ListPolicyEngines, chime:DescribeAppInstance, chime:ListAppInstances, chime:ListTagsForResource, dms:ListInstanceProfiles, emr-containers:DescribeManagedEndpoint, emr-containers:ListTagsForResource, gameliftstreams:GetApplication, gameliftstreams:GetStreamGroup, gameliftstreams:ListApplications, gameliftstreams:ListStreamGroups, gameliftstreams:ListTagsForResource, globalaccelerator:DescribeAcceleratorAttributes, glue:GetCatalog, glue:GetCatalogs, glue:GetSession, glue:ListSessions, lambda:ListCapacityProviders, medialive:DescribeNode, medialive:ListNodes, mediapackagev2:GetChannelPolicy, mediapackagev2:GetOriginEndpointPolicy, outposts:GetSite, outposts:ListSites, qbusiness:GetPolicy, redshift:DescribeDataShares, rtbfabric:GetInboundExternalLink, rtbfabric:GetLink, rtbfabric:GetOutboundExternalLink, rtbfabric:GetRequesterGateway, rtbfabric:GetResponderGateway, rtbfabric:ListLinks, rtbfabric:ListRequesterGateways, rtbfabric:ListResponderGateways, rtbfabric:ListTagsForResource, s3express:GetAccessPoint, s3express:GetAccessPointPolicy, s3express:GetAccessPointScope, s3express:ListAccessPointsForDirectoryBuckets, s3express:ListTagsForResource, s3vectors:GetVectorBucket, s3vectors:GetVectorBucketPolicy, s3vectors:ListTagsForResource, s3vectors:ListVectorBuckets, sagemaker:DescribeAutoMLJobV2, sagemaker:DescribeHyperParameterTuningJob, sagemaker:DescribePartnerApp, sagemaker:ListAutoMLJobs, sagemaker:ListHyperParameterTuningJobs, sagemaker:ListPartnerApps, servicecatalog:DescribeTagOption, servicecatalog:ListTagOptions, ssm-contacts:GetRotation, ssm-contacts:ListRotations, ssm-guiconnect:GetConnectionRecordingPreferences, sso:GetPermissionsBoundaryForPermissionSet, sso:ListCustomerManagedPolicyReferencesInPermissionSet, textract:GetAdapter, textract:ListAdapters, textract:ListTagsForResource, transfer:DescribeWebApp, transfer:DescribeWebAppCustomization, transfer:ListWebApps, wisdom:GetAIGuardrail, wisdom:ListAIGuardrails. | This policy now supports additional permissions for recording configuration changes across numerous AWS services. | March 10, 2026