AWS AmazonS3 documentation change
Summary
Clarified IAM role path requirements and updated example ARNs
Security assessment
Improves configuration accuracy but doesn't address security vulnerabilities. Focuses on correct ARN formatting rather than security controls.
Diff
diff --git a/AmazonS3/latest/userguide/replication-walkthrough-2.md b/AmazonS3/latest/userguide/replication-walkthrough-2.md index f751ac43d..d85c4f49a 100644 --- a//AmazonS3/latest/userguide/replication-walkthrough-2.md +++ b//AmazonS3/latest/userguide/replication-walkthrough-2.md @@ -42,8 +42 @@ Setting up live replication when the source and destination buckets are owned by -To use the following example, replace the ``user input placeholders`` with your own information. Replace ``amzn-s3-demo-destination-bucket`` with your destination bucket name. Replace ``source-bucket-account-ID`:role/service-role/`source-account-IAM-role`` in the IAM Amazon Resource Name (ARN) with the IAM role that you're using for this replication configuration. - -If you created the IAM service role manually, set the role path in the IAM ARN as `role/service-role/`, as shown in the following policy example. For more information, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns) in the _IAM User Guide_. - -JSON - - -**** +To use the following example, replace the ``user input placeholders`` with your own information. Replace ```amzn-s3-demo-destination-bucket``` with your destination bucket name. Replace ``source-bucket-account-ID`:role/`source-account-IAM-role`` in the IAM Amazon Resource Name (ARN) with the IAM role that you're using for this replication configuration. @@ -50,0 +44 @@ JSON +The role path in the IAM ARN depends on how you created the role. If you created the role with the AWS CLI (as shown in [Configuring replication for buckets in the same account](./replication-walkthrough1.html)), the path is `role/`role-name``. If you created the role with the IAM console as a service role, the path includes `service-role/` (that is, `role/service-role/`role-name``). For more information, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns) in the _IAM User Guide_. @@ -60 +54 @@ JSON - "AWS": "arn:aws:iam::111122223333:role/service-role/source-account-IAM-role" + "AWS": "arn:aws:iam::source-bucket-account-ID:role/source-account-IAM-role" @@ -72 +66 @@ JSON - "AWS": "arn:aws:iam::111122223333:role/service-role/source-account-IAM-role" + "AWS": "arn:aws:iam::source-bucket-account-ID:role/source-account-IAM-role"