AWS AmazonS3 documentation change
Summary
Added new permissions (s3:GetObjectAnnotation and s3:GetObjectVersionAnnotation) to IAM policy examples for cross-account batch operations
Security assessment
The change adds new IAM permissions related to object annotations but doesn't reference any security vulnerability. It enhances documentation about required permissions for cross-account operations, which is security-relevant but not tied to a specific security issue.
Diff
diff --git a/AmazonS3/latest/userguide/specify-batchjob-manifest-xaccount-csv.md b/AmazonS3/latest/userguide/specify-batchjob-manifest-xaccount-csv.md index 1d456f86e..6f57718ad 100644 --- a//AmazonS3/latest/userguide/specify-batchjob-manifest-xaccount-csv.md +++ b//AmazonS3/latest/userguide/specify-batchjob-manifest-xaccount-csv.md @@ -29,6 +28,0 @@ Then choose **Create policy** to attach the following policy to the role. To use -JSON - - -**** - - @@ -52 +46,3 @@ JSON - "s3:GetObjectVersionTagging" + "s3:GetObjectVersionTagging", + "s3:GetObjectAnnotation", + "s3:GetObjectVersionAnnotation" @@ -63,2 +59 @@ JSON - -Using the policy, the role grants `batchoperations.s3.amazonaws.com` permission to read the manifest in the source manifest bucket. It grants permissions to `GET` objects, access control lists (ACLs), tags, and versions in the source object bucket. It also grants permissions to `PUT` objects, ACLs, tags, and versions into the destination object bucket. +Using the policy, the role grants `batchoperations.s3.amazonaws.com` permission to read the manifest in the source manifest bucket. It grants permissions to `GET` objects, access control lists (ACLs), tags, annotations, and versions in the source object bucket. It also grants permissions to `PUT` objects, ACLs, tags, and versions into the destination object bucket. @@ -106,6 +100,0 @@ The following is an example of the bucket policy for the bucket that contains th -JSON - - -**** - - @@ -127 +116,3 @@ JSON - "s3:GetObjectVersionTagging" + "s3:GetObjectVersionTagging", + "s3:GetObjectAnnotation", + "s3:GetObjectVersionAnnotation"