AWS securityagent medium security documentation change

Service: securityagent · 2026-05-22 · Security-related medium

File: securityagent/latest/userguide/connect-agent-vpc.md

Summary

Added required IAM permissions for agent space service role to perform VPC penetration tests

Security assessment

Introduces specific IAM policy requirements for penetration testing operations. Missing these permissions could lead to security testing failures or unauthorized access attempts. The EC2 network interface permissions (CreateNetworkInterfacePermission, ModifyNetworkInterfaceAttribute) directly impact security posture by defining least-privilege access for security testing tools.

Diff

diff --git a/securityagent/latest/userguide/connect-agent-vpc.md b/securityagent/latest/userguide/connect-agent-vpc.md
index 4842e79e5..da81c83fe 100644
--- a//securityagent/latest/userguide/connect-agent-vpc.md
+++ b//securityagent/latest/userguide/connect-agent-vpc.md
@@ -7 +7 @@
-To add a VPC in the Agent SpaceTo select a specific VPC configuration for a penetration test in the Security Agent web appRunning a penetration test against VPC resources in another AWS account
+To add a VPC in the Agent SpaceRequired agent space service role permissionsTo select a specific VPC configuration for a penetration test in the Security Agent web appRunning a penetration test against VPC resources in another AWS account
@@ -41,0 +42,38 @@ You can add up to 5 VPCs.
+## Required agent space service role permissions
+
+In order to run a penetration test with a VPC, your agent space service role must include the following permissions:
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "ec2:CreateNetworkInterface",
+            "ec2:DescribeDhcpOptions",
+            "ec2:DescribeNetworkInterfaces",
+            "ec2:DescribeNetworkInterfaceAttribute",
+            "ec2:DescribeSubnets",
+            "ec2:DescribeSecurityGroups",
+            "ec2:DescribeVpcs",
+            "ec2:ModifyNetworkInterfaceAttribute",
+            "ec2:DeleteNetworkInterface"
+          ],
+          "Resource": "*"
+        },
+        {
+          "Effect": "Allow",
+          "Action": "ec2:CreateNetworkInterfacePermission",
+          "Resource": "arn:aws:ec2:{{region}}:{{accountId}}:network-interface/*",
+          "Condition": {
+            "ArnEquals": {
+              "ec2:Subnet": [
+                "arn:aws:ec2:{{region}}:{{accountId}}:subnet/[[subnetIds]]"
+              ]
+            }
+          }
+        }
+      ]
+    }
+