AWS solutions documentation change
Summary
Updated trust policy description and ARN specification to use two Lambda roles instead of account ID, with added instructions for role ARN retrieval
Security assessment
Clarifies that the trust policy must allow specific Lambda execution roles rather than the entire account. Improves security posture through precise access controls but doesn't fix a known vulnerability.
Diff
diff --git a/solutions/latest/spatial-data-management-on-aws/connector-rest-api.md b/solutions/latest/spatial-data-management-on-aws/connector-rest-api.md index 46c353e7a..e98b644f2 100644 --- a//solutions/latest/spatial-data-management-on-aws/connector-rest-api.md +++ b//solutions/latest/spatial-data-management-on-aws/connector-rest-api.md @@ -31 +31 @@ The REST API connector sends resource metadata to external REST endpoints. It su - * **Trust policy** must allow the SDMA solution account to assume it: + * **Trust policy** must allow the SDMA connector invocation Lambda to assume it: @@ -39 +39,4 @@ The REST API connector sends resource metadata to external REST endpoints. It su - "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole" + "AWS": [ + "<CONNECTOR_INVOCATION_ROLE_ARN>", + "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>" + ] @@ -46 +49,13 @@ The REST API connector sends resource metadata to external REST endpoints. It su -Replace `<SDMA_ACCOUNT_ID>` with the AWS account ID where SDMA is deployed. +Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment. + +If you have AWS CLI access, you can find these values by running: + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationFunction \ + --query 'Configuration.Role' --output text + + aws lambda get-function \ + --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \ + --query 'Configuration.Role' --output text + +Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`).