AWS security-ir documentation change
Summary
Replaced manual service-linked role creation instructions with information about automatic role creation during console onboarding
Security assessment
The change simplifies setup documentation but doesn't address any security vulnerability or weakness. It improves user experience by automating role creation without indicating any prior security issue.
Diff
diff --git a/security-ir/latest/userguide/select-a-membership-account.md b/security-ir/latest/userguide/select-a-membership-account.md index bba22500d..7bddf8f57 100644 --- a//security-ir/latest/userguide/select-a-membership-account.md +++ b//security-ir/latest/userguide/select-a-membership-account.md @@ -15,16 +15 @@ You have two options for selecting your AWS Security Incident Response membershi -###### Important - -When you use a delegated administrator account as part of setup, AWS Security Incident Response can't automatically create the required triage service linked role in your AWS Organizations management account. Complete the following steps to manually create this role in your AWS Organizations management account. - -###### Create a service-linked role (console) - - 1. Login to your AWS Organizations management account. - - 2. Access the [AWS CloudShell console](https://console.aws.amazon.com/cloudshell/home) or access the account through the AWS Command Line Interface using your preferred method. - - 3. Use the CLI command `aws iam create-service-linked-role --aws-service-name "triage.security-ir.amazonaws.com" --no-cli-pager`. - - 4. (Optional) To verify that the command worked, run the command `aws iam get-role --role-name AWSServiceRoleForSecurityIncidentResponse_Triage`. - - - +AWS Security Incident Response automatically creates the `AWSServiceRoleForSecurityIncidentResponse_Triage` service-linked role in your AWS Organizations management account and in all accounts that are in scope when onboarding through the AWS Security Incident Response console. For instructions on enabling AWS Security Incident Response and designating a delegated administrator account using the API/CLI, see [Enable Security Incident Response and configure your incident response team using the API/CLI](./enable-sir-using-cli.html).