AWS security-ir high security documentation change
Summary
Updated three AWS managed policies: added ListInvestigations action, changed to wildcard permissions, added AWS Organizations permissions, and removed MFA conditions
Security assessment
The removal of MFA conditions from security incident response policies is a significant security change that could reduce authentication requirements. The addition of wildcard permissions and new AWS Organizations permissions expands access. These changes directly impact security posture and access control.
Diff
diff --git a/security-ir/latest/userguide/aws-managed-policies.md b/security-ir/latest/userguide/aws-managed-policies.md index 816d9ab84..880f5261d 100644 --- a//security-ir/latest/userguide/aws-managed-policies.md +++ b//security-ir/latest/userguide/aws-managed-policies.md @@ -162,0 +163,3 @@ Change | Description | Date +Updated – AWSSecurityIncidentResponseReadOnlyAccess | The policy now includes the `security-ir:ListInvestigations` action. | April 22, 2026 +Updated – AWSSecurityIncidentResponseFullAccess | The policy now uses `security-ir:*` instead of listing explicit `security-ir` actions. Eight new AWS Organizations permissions were added (`organizations:ListAWSServiceAccessForOrganization`, `organizations:ListRoots`, `organizations:ListOrganizationalUnitsForParent`, `organizations:ListAccountsForParent`, `organizations:ListChildren`, `organizations:DescribeOrganizationalUnit`, `organizations:ListAccounts`, and `organizations:DescribeAccount`) to support the console's account picker when updating associations. The MFA condition has been removed. | April 22,2026 +Updated – AWSSecurityIncidentResponseCaseFullAccess | The policy now includes two new actions: `security-ir:ListInvestigations` and `security-ir:SendFeedback`. The MFA condition has been removed. | April 22, 2026