AWS batch documentation change
Summary
Added clarification that service-linked role auto-creation only applies to MANAGED compute environments, and UNMANAGED environments require explicit serviceRole specification
Security assessment
The change clarifies role requirements but doesn't address any security vulnerability or weakness. It prevents misconfiguration errors, not security exploits.
Diff
diff --git a/batch/latest/userguide/using-service-linked-roles-batch-general.md b/batch/latest/userguide/using-service-linked-roles-batch-general.md index 92ba77eac..482f3c1b6 100644 --- a//batch/latest/userguide/using-service-linked-roles-batch-general.md +++ b//batch/latest/userguide/using-service-linked-roles-batch-general.md @@ -27,0 +28,4 @@ For more information, see [Incorrect role name or ARN](./invalid_compute_environ +###### Important + +Service-linked role auto-creation only applies to `MANAGED` compute environments. For `UNMANAGED` compute environments, you must explicitly specify a `serviceRole`. Omitting the role for an `UNMANAGED` compute environment results in a `ServiceRole is required` error. + @@ -65,0 +70,4 @@ You don't need to manually create a service-linked role. When you create a compu +###### Note + +This automatic service-linked role creation only applies to `MANAGED` compute environments. For `UNMANAGED` compute environments, you must explicitly provide a `serviceRole` when calling `CreateComputeEnvironment`. +