AWS AmazonCloudWatch documentation change
Summary
Simplified log group ARN format documentation by removing the dual ARN format explanation and trailing '*:' syntax guidance
Security assessment
This change simplifies ARN documentation but removes guidance about when to use different ARN formats for tagging APIs. No evidence of security vulnerability being addressed; it's a documentation cleanup that might impact policy creation accuracy but doesn't directly relate to security issues.
Diff
diff --git a/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.md b/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.md index 3ce2a325c..90326b8e2 100644 --- a//AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.md +++ b//AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.md @@ -53,7 +53 @@ Resource type | ARN format -Log group | Both of the following are used. The second one, with the `:*` at the end, is what is returned by the `describe-log-groups` CLI command and the **DescribeLogGroups** API. arn:aws:logs:`region`:`account-id`:log-group:`log_group_name` arn:aws:logs:`region`:`account-id`:log-group:`log_group_name`:* Use the first version, without the trailing `:*`, in the following situations: - - * In the `logGroupIdentifier` input field in many CloudWatch Logs APIs. - * In the `resourceArn` field in tagging APIs - * In IAM policies, when specifying permissions for [TagResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TagResource.html), [UntagResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UntagResource.html), and [ListTagsForResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListTagsForResource.html). - -Use the second version, with the trailing `:*`, to refer to the ARN when specifying permissions in IAM policies for all other API actions. +Log group | arn:aws:logs:`region`:`account-id`:log-group:`log_group_name`