AWS opensearch-service documentation change
Summary
Removed detailed IAM permission guidance and programmatic access instructions. Added basic sign-up information.
Security assessment
The change removes security best practices (finer-grained policies, temporary credentials) but doesn't reference any specific vulnerability. The addition of account sign-up is non-security related.
Diff
diff --git a/opensearch-service/latest/developerguide/setting-up.md b/opensearch-service/latest/developerguide/setting-up.md index 5f88219b1..bd2af7dd0 100644 --- a//opensearch-service/latest/developerguide/setting-up.md +++ b//opensearch-service/latest/developerguide/setting-up.md @@ -13,48 +13 @@ Grant permissionsSet up the AWS CLIOpen the console -In production environments, we recommend that you use finer-grained policies. To learn more about access management, see [Access management for AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/access.html) in the IAM User Guide. - -To provide access, add permissions to your users, groups, or roles: - - * Users and groups in AWS IAM Identity Center: - -Create a permission set. Follow the instructions in [Create a permission set](https://docs.aws.amazon.com//singlesignon/latest/userguide/howtocreatepermissionset.html) in the _AWS IAM Identity Center User Guide_. - - * Users managed in IAM through an identity provider: - -Create a role for identity federation. Follow the instructions in [Create a role for a third-party identity provider (federation)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-idp.html) in the _IAM User Guide_. - - * IAM users: - - * Create a role that your user can assume. Follow the instructions in [Create a role for an IAM user](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-user.html) in the _IAM User Guide_. - - * (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in [Adding permissions to a user (console)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) in the _IAM User Guide_. - - - - -### Grant programmatic access - -Users need programmatic access if they want to interact with AWS outside of the AWS Management Console. The way to grant programmatic access depends on the type of user that's accessing AWS. - -To grant users programmatic access, choose one of the following options. - -Which user needs programmatic access? | To | By ----|---|--- -IAM | (Recommended) Use console credentials as temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. - - * For the AWS CLI, see [Login for AWS local development](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sign-in.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs, see [Login for AWS local development](https://docs.aws.amazon.com//sdkref/latest/guide/access-login.html) in the _AWS SDKs and Tools Reference Guide_. - - -Workforce identity (Users managed in IAM Identity Center) | Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. - - * For the AWS CLI, see [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs, tools, and AWS APIs, see [IAM Identity Center authentication](https://docs.aws.amazon.com//sdkref/latest/guide/access-sso.html) in the _AWS SDKs and Tools Reference Guide_. - - -IAM | Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions in [Using temporary credentials with AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html) in the _IAM User Guide_. -IAM | (Not recommended)Use long-term credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. - - * For the AWS CLI, see [Authenticating using IAM user credentials](https://docs.aws.amazon.com//cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs and tools, see [Authenticate using long-term credentials](https://docs.aws.amazon.com//sdkref/latest/guide/access-iam-users.html) in the _AWS SDKs and Tools Reference Guide_. - * For AWS APIs, see [Managing access keys for IAM users](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. - +### Sign up for an AWS account @@ -61,0 +15 @@ IAM | (Not recommended)Use long-term credentials to sign programmatic requests t +To get started with AWS, you need an AWS account. For information about creating an AWS account, see [Getting started with an AWS account](https://docs.aws.amazon.com//accounts/latest/reference/getting-started.html) in the _AWS Account Management Reference Guide_.