AWS transform documentation change

Service: transform · 2026-05-01 · Documentation low

File: transform/latest/userguide/security-iam-awsmanpol.md

Summary

Updated managed policies to include permissions for creating service-linked roles enabling CloudWatch metrics emission

Security assessment

The change adds operational permissions for CloudWatch metrics collection without addressing security vulnerabilities or introducing security features. The service-linked role creation is a standard operational capability with no evidence of security remediation or new security controls.

Diff

diff --git a/transform/latest/userguide/security-iam-awsmanpol.md b/transform/latest/userguide/security-iam-awsmanpol.md
index 740ce5ee4..041590547 100644
--- a//transform/latest/userguide/security-iam-awsmanpol.md
+++ b//transform/latest/userguide/security-iam-awsmanpol.md
@@ -24,0 +25,2 @@ Change | Description | Date
+AWSTransformCustomExecuteTransformations – Updated policy |  Added permission to create the AWS Transform custom service-linked role (`AWSServiceRoleForAWSTransformCustom`) to enable CloudWatch metrics emission to customer accounts. | April 27, 2026  
+AWSTransformCustomManageTransformations – Updated policy |  Added permission to create the AWS Transform custom service-linked role (`AWSServiceRoleForAWSTransformCustom`) to enable CloudWatch metrics emission to customer accounts. | April 27, 2026  
@@ -146,0 +149,2 @@ This policy includes the following permissions:
+  * **AWS Identity and Access Management (IAM)** – Allows creating the AWS Transform custom [service-linked role](./using-service-linked-roles.html#using-service-linked-roles-custom) (`AWSServiceRoleForAWSTransformCustom`). This role is required for AWS Transform custom to emit CloudWatch metrics to your account. The permission is scoped to only allow creating this specific service-linked role.
+
@@ -169,0 +174,2 @@ This policy includes the following permissions:
+  * **AWS Identity and Access Management (IAM)** – Allows creating the AWS Transform custom [service-linked role](./using-service-linked-roles.html#using-service-linked-roles-custom) (`AWSServiceRoleForAWSTransformCustom`). This role is required for AWS Transform custom to emit CloudWatch metrics to your account. The permission is scoped to only allow creating this specific service-linked role.
+