AWS solutions medium security documentation change
Summary
Updated IAM role references from single account-based ARN to dual Lambda execution role ARNs. Added CLI/Lambda console instructions for retrieving correct role ARNs. Clarified trust policy requirements.
Security assessment
The change replaces hardcoded account IDs with explicit role ARNs and adds instructions to retrieve execution roles. This prevents misconfiguration of trust policies which could allow unauthorized access. Explicitly specifying both sync/async Lambda roles improves least-privilege security.
Diff
diff --git a/solutions/latest/spatial-data-management-on-aws/connector-derivation.md b/solutions/latest/spatial-data-management-on-aws/connector-derivation.md index 7c0e41b59..3521d9c41 100644 --- a//solutions/latest/spatial-data-management-on-aws/connector-derivation.md +++ b//solutions/latest/spatial-data-management-on-aws/connector-derivation.md @@ -93 +93,4 @@ The `s3Lookup` operation reads a file from S3 and parses it into records. It sup - "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole" + "AWS": [ + "<CONNECTOR_INVOCATION_ROLE_ARN>", + "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>" + ] @@ -100 +103,13 @@ The `s3Lookup` operation reads a file from S3 and parses it into records. It sup -Replace `<SDMA_ACCOUNT_ID>` with the AWS account ID where SDMA is deployed. +Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment. + +If you have AWS CLI access, you can find these values by running: + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationFunction \ + --query 'Configuration.Role' --output text + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \ + --query 'Configuration.Role' --output text + +Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`). @@ -185 +200 @@ The `restLookup` operation calls a REST API endpoint and parses the response int - * **Trust policy** must allow the SDMA solution account to assume it: + * **Trust policy** must allow the SDMA connector invocation Lambda to assume it: @@ -193 +208,4 @@ The `restLookup` operation calls a REST API endpoint and parses the response int - "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole" + "AWS": [ + "<CONNECTOR_INVOCATION_ROLE_ARN>", + "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>" + ] @@ -200 +218,13 @@ The `restLookup` operation calls a REST API endpoint and parses the response int -Replace `<SDMA_ACCOUNT_ID>` with the AWS account ID where SDMA is deployed. +Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment. + +If you have AWS CLI access, you can find these values by running: + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationFunction \ + --query 'Configuration.Role' --output text + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \ + --query 'Configuration.Role' --output text + +Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`). @@ -278 +308 @@ The `dynamodbLookup` operation performs a GetItem on a DynamoDB table and return - * **Trust policy** must allow the SDMA solution account to assume it: + * **Trust policy** must allow the SDMA connector invocation Lambda to assume it: @@ -286 +316,4 @@ The `dynamodbLookup` operation performs a GetItem on a DynamoDB table and return - "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole" + "AWS": [ + "<CONNECTOR_INVOCATION_ROLE_ARN>", + "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>" + ] @@ -293 +326,13 @@ The `dynamodbLookup` operation performs a GetItem on a DynamoDB table and return -Replace `<SDMA_ACCOUNT_ID>` with the AWS account ID where SDMA is deployed. +Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment. + +If you have AWS CLI access, you can find these values by running: + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationFunction \ + --query 'Configuration.Role' --output text + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \ + --query 'Configuration.Role' --output text + +Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`).