AWS transform medium security documentation change
Summary
Added new sections on IAM-only access configuration, IAM credential usage, and enabling IAM access alongside identity providers. Updated terminology from 'Click' to 'Choose' and modified a section title.
Security assessment
Documents IAM-only authentication method and clarifies that email notifications are disabled for IAM users. Highlights potential dual identity risks where users with both IAM and SSO sessions appear as separate unlinked identities, which could lead to permission confusion or audit trail gaps.
Diff
diff --git a/transform/latest/userguide/transform-setup.md b/transform/latest/userguide/transform-setup.md index c5c6f842a..d197655c4 100644 --- a//transform/latest/userguide/transform-setup.md +++ b//transform/latest/userguide/transform-setup.md @@ -7 +7 @@ -Before you beginGetting started with AWS OrganizationsGetting started with AWS IAM Identity CenterUsing third-party identity providersOnboarding +Before you beginGetting started with IAM-only accessUsing IAM credentialsGetting started with AWS OrganizationsGetting started with AWS IAM Identity CenterUsing third-party identity providersOnboarding @@ -18,0 +19,68 @@ If you want to try out AWS Transform as a proof-of-concept or for test environme +## Getting started with IAM-only access + +With IAM-only access, users authenticate with their existing AWS credentials. + +To set up IAM-only access: + + 1. In the AWS console, navigate to AWS Transform and choose **Get started**. + + 2. Complete the account settings configuration. + + 3. Under **User access** , select **IAM-only access**. + + 4. Choose **Enable** to create your profile. + + + + +Users log in to the AWS Transform web application through [AWS Sign-In](https://docs.aws.amazon.com/signin/latest/userguide/what-is-sign-in.html). Their user identifier in the web application is based on their IAM principal. + +###### Important + +You cannot add an identity provider after setup is complete. To manage users with IAM Identity Center or an existing identity provider, choose one of those options during initial setup. + +With IAM-only access, any IAM principal with the `transform:AccessTransformProfile` permission on the profile resource can access AWS Transform. You manage user access through IAM policies rather than through identity provider user assignments. + +The `transform:AccessTransformProfile` action only grants access to AWS Transform. Once inside AWS Transform, workspace roles control what actions a user can perform. These roles include Admin, Contributor, Approver, and Read-only. Workspace roles apply regardless of how the user authenticated. + +## Using IAM credentials + +### User information handling + +When IAM principals access AWS Transform, the service handles user identity differently than with identity provider-based access. + +User identity + + +IAM users are identified by their [IAM principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html). + +Dual identity + + +A user who has both an identity provider identity (such as IAM Identity Center) and an IAM session appears as two separate users in AWS Transform. Their work is not linked between the two identities. + +Email notifications + + +Email notifications are only enabled for SSO users. IAM principals can still be added to workspaces but they will not receive email notifications. + +Audit + + +IAM API calls are logged in AWS CloudTrail with the caller's IAM identity. Actions performed by IAM users in a job are also traceable in AWS Transform worklogs. + +### Enabling IAM access alongside an identity provider + +If you set up AWS Transform with IAM Identity Center or a third-party identity provider, you can also enable IAM access as an additional way to authenticate. This allows IAM principals to access AWS Transform alongside your existing identity provider users. + +IAM access is enabled by default when you create a profile with IAM Identity Center or a third-party identity provider. To enable or disable IAM access at any time: + + 1. In the AWS Transform console, navigate to **Settings**. + + 2. Under **Access AWS Transform with IAM credentials** , toggle **Enable IAM access** on or off. + + + + +When IAM access is enabled, both identity provider users and IAM principals can use AWS Transform. IAM users and identity provider users can collaborate in the same workspace. + @@ -68 +136 @@ Configure IAM Identity Center to use an external enterprise identity provider, a -Click **View profile** to view the configuration. The Web application URL is used by your users to access the AWS Transform unified web experience. +Choose **View profile** to view the configuration. The Web application URL is used by your users to access the AWS Transform unified web experience. @@ -279 +347 @@ Getting started -Managing users +Using your own S3 bucket