AWS elasticbeanstalk documentation change
Summary
Updated instance profile permissions for AI analysis to include AWS Marketplace permissions (aws-marketplace:Subscribe, etc.) for first-time use of Anthropic Claude models.
Security assessment
The change enhances documentation on IAM permissions needed for secure access to AI features, focusing on access control, but does not indicate a security vulnerability or incident; it is an update to permission requirements.
Diff
diff --git a/elasticbeanstalk/latest/dg/iam-instanceprofile.md b/elasticbeanstalk/latest/dg/iam-instanceprofile.md index 012b61f37..65dbff7da 100644 --- a//elasticbeanstalk/latest/dg/iam-instanceprofile.md +++ b//elasticbeanstalk/latest/dg/iam-instanceprofile.md @@ -67 +67 @@ To customize permissions, you can add policies to the role attached to the defau -To use the [AI-powered environment analysis](./health-ai-analysis.html) feature, add the `bedrock:InvokeModel`, `bedrock:ListFoundationModels`, `elasticbeanstalk:DescribeEvents`, and `elasticbeanstalk:DescribeEnvironmentHealth` permissions to your instance profile. These permissions allow Elastic Beanstalk to use Amazon Bedrock and access environment data for analyzing logs, events, and instance health. +To use the [AI-powered environment analysis](./health-ai-analysis.html) feature, add the `bedrock:InvokeModel`, `bedrock:ListFoundationModels`, `elasticbeanstalk:DescribeEvents`, and `elasticbeanstalk:DescribeEnvironmentHealth` permissions to your instance profile. These permissions allow Elastic Beanstalk to use Amazon Bedrock and access environment data for analyzing logs, events, and instance health. If this is the first time an Anthropic Claude model is being used in your AWS account, also add the `aws-marketplace:Subscribe`, `aws-marketplace:Unsubscribe`, and `aws-marketplace:ViewSubscriptions` permissions. These AWS Marketplace permissions enable the automatic model subscription that Amazon Bedrock requires for first-time access to third-party models.