AWS serverless-application-model documentation change
Summary
Restructured the setup steps: removed detailed instructions for creating IAM users and access keys, renumbered steps, and simplified account setup with a reference link.
Security assessment
The change removes security best practices content about IAM user creation, temporary credentials, and access key management. This could lead to users implementing less secure configurations by omitting guidance on avoiding long-term credentials. However, there's no evidence it fixes a specific security vulnerability.
Diff
diff --git a/serverless-application-model/latest/developerguide/serverless-getting-started-set-up-credentials.md b/serverless-application-model/latest/developerguide/serverless-getting-started-set-up-credentials.md index 4f544ac20..b0a277864 100644 --- a//serverless-application-model/latest/developerguide/serverless-getting-started-set-up-credentials.md +++ b//serverless-application-model/latest/developerguide/serverless-getting-started-set-up-credentials.md @@ -7 +7 @@ -Step 1: Sign up for an AWS accountStep 2: Create an IAM user accountStep 3: Create an access key ID and secret access keyStep 4: Install the AWS CLIStep 5: Use the AWS CLI to configure AWS credentialsStep 6: (Optional) Install AWS Toolkit for VS CodeNext steps +Sign up for an AWS accountStep 1: Install the AWS CLIStep 2: Use the AWS CLI to configure AWS credentialsStep 3: (Optional) Install AWS Toolkit for VS CodeNext steps @@ -24 +24 @@ To use the AWS SAM CLI, you need the following: - * Step 1: Sign up for an AWS account + * Sign up for an AWS account @@ -26 +26 @@ To use the AWS SAM CLI, you need the following: - * Step 2: Create an IAM user account + * Step 1: Install the AWS CLI @@ -28 +28 @@ To use the AWS SAM CLI, you need the following: - * Step 3: Create an access key ID and secret access key + * Step 2: Use the AWS CLI to configure AWS credentials @@ -30,5 +30 @@ To use the AWS SAM CLI, you need the following: - * Step 4: Install the AWS CLI - - * Step 5: Use the AWS CLI to configure AWS credentials - - * Step 6: (Optional) Install AWS Toolkit for VS Code + * Step 3: (Optional) Install AWS Toolkit for VS Code @@ -41,55 +37 @@ To use the AWS SAM CLI, you need the following: -## Step 1: Sign up for an AWS account - -If you do not have an AWS account, complete the following steps to create one. - -###### To sign up for an AWS account - - 1. Open [https://portal.aws.amazon.com/billing/signup](https://portal.aws.amazon.com/billing/signup). - - 2. Follow the online instructions. - -Part of the sign-up procedure involves receiving a phone call or text message and entering a verification code on the phone keypad. - -When you sign up for an AWS account, an _AWS account root user_ is created. The root user has access to all AWS services and resources in the account. As a security best practice, assign administrative access to a user, and use only the root user to perform [tasks that require root user access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks). - - - - -## Step 2: Create an IAM user account - -To create an administrator user, choose one of the following options. - -Choose one way to manage your administrator | To | By | You can also ----|---|---|--- -In IAM Identity Center (Recommended) | Use short-term credentials to access AWS.This aligns with the security best practices. For information about best practices, see [Security best practices in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-users-federation-idp) in the _IAM User Guide_. | Following the instructions in [Getting started](https://docs.aws.amazon.com//singlesignon/latest/userguide/getting-started.html) in the _AWS IAM Identity Center User Guide_. | Configure programmatic access by [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. -In IAM (Not recommended) | Use long-term credentials to access AWS. | Following the instructions in [ Create an IAM user for emergency access](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started-emergency-iam-user.html) in the _IAM User Guide_. | Configure programmatic access by [Manage access keys for IAM users](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. - -## Step 3: Create an access key ID and secret access key - -For CLI access, you need an access key ID and a secret access key. Use temporary credentials instead of long-term access keys when possible. Temporary credentials include an access key ID, a secret access key, and a security token that indicates when the credentials expire. For more information, see [ Using temporary credentials with AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html) in the _IAM User Guide_. - -Users need programmatic access if they want to interact with AWS outside of the AWS Management Console. The way to grant programmatic access depends on the type of user that's accessing AWS. - -To grant users programmatic access, choose one of the following options. - -Which user needs programmatic access? | To | By ----|---|--- -IAM | (Recommended) Use console credentials as temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. - - * For the AWS CLI, see [Login for AWS local development](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sign-in.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs, see [Login for AWS local development](https://docs.aws.amazon.com//sdkref/latest/guide/access-login.html) in the _AWS SDKs and Tools Reference Guide_. - - -Workforce identity (Users managed in IAM Identity Center) | Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. - - * For the AWS CLI, see [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs, tools, and AWS APIs, see [IAM Identity Center authentication](https://docs.aws.amazon.com//sdkref/latest/guide/access-sso.html) in the _AWS SDKs and Tools Reference Guide_. - - -IAM | Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions in [Using temporary credentials with AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html) in the _IAM User Guide_. -IAM | (Not recommended)Use long-term credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. - - * For the AWS CLI, see [Authenticating using IAM user credentials](https://docs.aws.amazon.com//cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs and tools, see [Authenticate using long-term credentials](https://docs.aws.amazon.com//sdkref/latest/guide/access-iam-users.html) in the _AWS SDKs and Tools Reference Guide_. - * For AWS APIs, see [Managing access keys for IAM users](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. - +## Sign up for an AWS account @@ -96,0 +39 @@ IAM | (Not recommended)Use long-term credentials to sign programmatic requests t +To get started with AWS, you need an AWS account. For information about creating an AWS account, see [Getting started with an AWS account](https://docs.aws.amazon.com//accounts/latest/reference/getting-started.html) in the _AWS Account Management Reference Guide_. @@ -98 +41 @@ IAM | (Not recommended)Use long-term credentials to sign programmatic requests t -## Step 4: Install the AWS CLI +## Step 1: Install the AWS CLI @@ -104 +47 @@ To install the AWS CLI, see [ Installing or updating the latest version of the A -## Step 5: Use the AWS CLI to configure AWS credentials +## Step 2: Use the AWS CLI to configure AWS credentials @@ -142 +85 @@ For more information on configuring credentials, such as using an existing confi -## Step 6: (Optional) Install AWS Toolkit for VS Code +## Step 3: (Optional) Install AWS Toolkit for VS Code