AWS connect documentation change
Summary
Added granular permissions for case management including deletion rights for cases/comments/attachments, and differentiated between global vs user-owned resource permissions
Security assessment
The changes document new IAM permissions for case resource management (delete/edit operations) and implement principle of least privilege by separating 'All Cases' vs 'My Cases' permissions. While this enhances security controls, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/connect/latest/adminguide/assign-security-profile-cases.md b/connect/latest/adminguide/assign-security-profile-cases.md index 315d29d02..93eda1a48 100644 --- a//connect/latest/adminguide/assign-security-profile-cases.md +++ b//connect/latest/adminguide/assign-security-profile-cases.md @@ -46,0 +47,6 @@ To be able to assign case ownership to users or queues, agents need permissions + * **Delete case** : Allows the user to delete any case in the domain. + + * **My Cases** : Manage if the user can delete cases that they created. + + * **Delete case** : Allows the user to delete cases that they created. + @@ -57 +63 @@ To be able to assign case ownership to users or queues, agents need permissions - * **View Case Fields** : Allows users to view the case fields page and all of the existing case fields (could be system or custom). + * **View Case Templates** : Allows users to view the case templates page and all of the existing case templates. @@ -59 +65 @@ To be able to assign case ownership to users or queues, agents need permissions - * **Edit Case Fields** : Allows users to edit any of the case fields (for example, change title, description, single-select options). + * **Edit Case Templates** : Allows users to edit any of the case templates. @@ -61 +67,37 @@ To be able to assign case ownership to users or queues, agents need permissions - * **Create Case Fields** : Allows users to create new case fields. + * **Create Case Templates** : Allows users to create new case templates. + + * **Case Comments** : Manage who can edit or delete comments on any case, regardless of who authored them. + + * **Edit Case Comment** : Allows the user to edit any comment on a case. + + * **Delete Case Comment** : Allows the user to delete any comment on a case. + + * **My Case Comments** : Manage if the user can edit or delete comments that they authored. + + * **Edit Case Comment** : Allows the user to edit comments that they authored. + + * **Delete Case Comment** : Allows the user to delete comments that they authored. + + * **Case Custom Related Items** : Manage who can edit or delete custom related items on any case, regardless of who created them. + + * **Edit Case Custom Related Item** : Allows the user to edit any custom related item on a case. + + * **Delete Case Custom Related Item** : Allows the user to delete any custom related item from a case. + + * **My Case Custom Related Items** : Manage if the user can edit or delete custom related items that they created. + + * **Edit Case Custom Related Item** : Allows the user to edit custom related items that they created. + + * **Delete Case Custom Related Item** : Allows the user to delete custom related items that they created. + + * **Case Contacts** : Manage who can remove contact associations (calls, chats, tasks, emails) from any case, regardless of who associated the contact. + + * **Delete Case Contact** : Allows the user to remove any contact associated with a case. + + * **My Case Contacts** : Manage if the user can remove contact associations that they created. + + * **Delete Case Contact** : Allows the user to remove contact associations that they created. + + * **Case Files** : Manage who can remove files attached to cases. + + * **Delete Case File** : Allows the user to delete any file attached to a case.