AWS AmazonCloudWatch medium security documentation change
Summary
Updated references from service-linked role 'AWSServiceRoleForCloudWatchCrossAccount' to new service role 'ServiceRoleForCloudWatchCrossAccountV2' throughout the document
Security assessment
The change introduces a new IAM service role version (V2) with updated naming convention, indicating an underlying security enhancement or policy update. Modifying core access roles for cross-account monitoring directly impacts authorization security. The explicit version increment suggests security improvements in the role's permission boundaries or trust policies.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.md b/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.md index cceb9d1cb..966e5536b 100644 --- a//AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.md +++ b//AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.md @@ -156 +156 @@ Enable each monitoring account if you want to view cross-account CloudWatch data -When you complete the following procedure, CloudWatch creates a service-linked role that CloudWatch uses in the monitoring account to access data shared from your other accounts. This service-linked role is called **AWSServiceRoleForCloudWatchCrossAccount**. For more information, see [Using service-linked roles for CloudWatch](./using-service-linked-roles.html). +When you complete the following procedure, CloudWatch creates a service role that CloudWatch uses in the monitoring account to access data shared from your other accounts. This service role is called **ServiceRoleForCloudWatchCrossAccountV2**. @@ -223 +223 @@ Check the following: - * Your monitoring account should have a role named **AWSServiceRoleForCloudWatchCrossAccount**. If it does not, you need to create this role. For more information, see Set Up a Monitoring Account. + * Your monitoring account should have a role named **ServiceRoleForCloudWatchCrossAccountV2**. If it does not, you need to create this role. For more information, see Set Up a Monitoring Account. @@ -244 +244 @@ Check the following: - 3. In the list of roles, make sure the needed role exists. In a sharing account, look for **CloudWatch-CrossAccountSharingRole**. In a monitoring account, look for **AWSServiceRoleForCloudWatchCrossAccount**. + 3. In the list of roles, make sure the needed role exists. In a sharing account, look for **CloudWatch-CrossAccountSharingRole**. In a monitoring account, look for **ServiceRoleForCloudWatchCrossAccountV2**. @@ -310 +310 @@ If you didn't use the CloudFormation stacks to enable cross-account functionalit -**Step 2: Remove the service-linked role** +**Step 2: Remove the service role** @@ -312 +312 @@ If you didn't use the CloudFormation stacks to enable cross-account functionalit -In the monitoring account, delete the **AWSServiceRoleForCloudWatchCrossAccount** service-linked IAM role. +In the monitoring account, delete the **ServiceRoleForCloudWatchCrossAccountV2** IAM service role.