AWS guardduty documentation change
Summary
Added two entries to document history: 1) Updated AmazonGuardDutyServiceRolePolicy with new permissions (s3:ListBucket, ecs:DescribeTasks, ecs:DescribeTaskDefinition). 2) Documented new GuardDuty Runtime Monitoring security agent version 1.12.2 for EKS.
Security assessment
The change documents updates to a security service (GuardDuty) including policy permissions and agent version. While these updates could enhance security monitoring capabilities, there is no explicit mention of addressing a specific security vulnerability or incident. The policy update expands permissions for the service-linked role, which is a routine operational update.
Diff
diff --git a/guardduty/latest/ug/doc-history.md b/guardduty/latest/ug/doc-history.md index c87806496..732fd03ee 100644 --- a//guardduty/latest/ug/doc-history.md +++ b//guardduty/latest/ug/doc-history.md @@ -14,0 +15,2 @@ Change| Description| Date +Updated AmazonGuardDutyServiceRolePolicy| Added `s3:ListBucket`, `ecs:DescribeTasks`, and `ecs:DescribeTaskDefinition` permissions to the GuardDuty service-linked role. For more information, see [GuardDuty updates to AWS managed policies](https://docs.aws.amazon.com/guardduty/latest/ug/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| April 23, 2026 +Updated functionality - Runtime Monitoring| GuardDuty Runtime Monitoring releases the new security agent version 1.12.2 for Amazon EKS resources. For more information about the new agent version and a list of additional resources to update your security agent, see [GuardDuty security agent release versions](https://docs.aws.amazon.com/guardduty/latest/ug/runtime-monitoring-agent-release-history.html).| April 22, 2026