AWS solutions medium security documentation change

Service: solutions · 2026-06-07 · Security-related medium

File: solutions/latest/spatial-data-management-on-aws/connector-eventbridge.md

Summary

Updated IAM role reference from single account-based ARN to dual Lambda execution role ARNs. Added CLI/Lambda console instructions for retrieving correct role ARNs.

Security assessment

Transition from account-based permissions to explicit role ARNs enhances security by minimizing attack surface. Dual role specification ensures both sync/async functions have necessary permissions without over-provisioning access.

Diff

diff --git a/solutions/latest/spatial-data-management-on-aws/connector-eventbridge.md b/solutions/latest/spatial-data-management-on-aws/connector-eventbridge.md
index 59537acc9..8b3640575 100644
--- a//solutions/latest/spatial-data-management-on-aws/connector-eventbridge.md
+++ b//solutions/latest/spatial-data-management-on-aws/connector-eventbridge.md
@@ -38 +38,4 @@ Step type |  Participates in multi-step triggers alongside other step types. An
-                "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole"
+                "AWS": [
+                  "<CONNECTOR_INVOCATION_ROLE_ARN>",
+                  "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>"
+                ]
@@ -44,0 +48,14 @@ Step type |  Participates in multi-step triggers alongside other step types. An
+Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment.
+
+If you have AWS CLI access, you can find these values by running:
+        
+                aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationFunction \
+          --query 'Configuration.Role' --output text
+        
+        aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \
+          --query 'Configuration.Role' --output text
+
+Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`).
+