AWS signin documentation change
Summary
Added documentation for new AWS managed policy 'AWSSignInResourcePolicyManagement' that grants permissions to manage console authorization configurations and resource permission statements
Security assessment
The change introduces a new managed policy with permissions to configure authorization settings and resource permissions for AWS Sign-In. While this enables security controls for console access, there's no evidence it addresses a specific vulnerability. It documents security features for access management.
Diff
diff --git a/signin/latest/userguide/security-iam-awsmanpol.md b/signin/latest/userguide/security-iam-awsmanpol.md index 5730c651e..45da45147 100644 --- a//signin/latest/userguide/security-iam-awsmanpol.md +++ b//signin/latest/userguide/security-iam-awsmanpol.md @@ -7 +7 @@ -AmazonManagedSignUpServicePolicyApplicationProvisioningPolicySignInLocalDevelopmentAccessPolicy updates +AmazonManagedSignUpServicePolicyApplicationProvisioningPolicySignInLocalDevelopmentAccessAWSSignInResourcePolicyManagementPolicy updates @@ -98,0 +99,57 @@ For more information, see [Login with console credentials (Recommended)](./comma +## AWS managed policy: AWSSignInResourcePolicyManagement + +The `AWSSignInResourcePolicyManagement` policy grants permissions to manage console authorization configuration and resource permission statements for AWS Sign-In. + +You can attach `AWSSignInResourcePolicyManagement` to your users, groups, and roles. + +**Permissions details** + +This policy includes the following permissions: + + * `signin:PutConsoleAuthorizationConfiguration` – Create or update console authorization settings. + + * `signin:GetConsoleAuthorizationConfiguration` – Retrieve the current console authorization configuration. + + * `signin:DeleteConsoleAuthorizationConfiguration` – Remove the console authorization configuration. + + * `signin:PutResourcePermissionStatement` – Create or update resource permission statements. + + * `signin:DeleteResourcePermissionStatement` – Remove resource permission statements. + + * `signin:ListResourcePermissionStatements` – List resource permission statements for the account. + + * `signin:GetResourcePolicy` – Retrieve the consolidated resource-based policy. + + + + +The following is the policy JSON: + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "signin:PutConsoleAuthorizationConfiguration", + "signin:GetConsoleAuthorizationConfiguration", + "signin:DeleteConsoleAuthorizationConfiguration", + "signin:PutResourcePermissionStatement", + "signin:DeleteResourcePermissionStatement", + "signin:ListResourcePermissionStatements", + "signin:GetResourcePolicy" + ], + "Resource": "*" + } + ] + } + +Attach this policy to IAM principals (users or roles) who manage resource-based policies for AWS Sign-In. This includes security administrators responsible for configuring network-based access controls, compliance officers who need to audit console access policies, and operations teams managing emergency recovery access configurations. + +###### Important + +This policy grants administrative access to console authorization controls. Apply the principle of least privilege when assigning this policy. Consider using IAM conditions to further restrict when and how these permissions can be used. + +To view more details about the policy, including the latest version of the JSON policy document, see [AWSSignInResourcePolicyManagement](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSignInResourcePolicyManagement.html) in the _AWS Managed Policy Reference Guide_. + @@ -104,0 +162 @@ Change | Description | Date +AWSSignInResourcePolicyManagement – New policy | Added a new AWS managed policy that grants permissions to manage console authorization configuration and resource permission statements for AWS Sign-In. | June 10, 2026