AWS directoryservice documentation change
Summary
Streamlined prerequisites section: condensed instructions, restructured IAM permission guidance, and clarified regional requirements for enabling user/group management
Security assessment
Changes improve clarity but don't address vulnerabilities. IAM permission references are relocated, not added. Regional enablement clarification is operational, not security-focused.
Diff
diff --git a/directoryservice/latest/admin-guide/copy_group_membership.md b/directoryservice/latest/admin-guide/copy_group_membership.md index d19e2f959..f341e8e45 100644 --- a//directoryservice/latest/admin-guide/copy_group_membership.md +++ b//directoryservice/latest/admin-guide/copy_group_membership.md @@ -11 +11 @@ You can copy group memberships from one AWS Managed Microsoft AD user into anoth -###### Before you begin this procedure, you need to complete the following: +###### Before you begin, complete the following: @@ -15 +15 @@ You can copy group memberships from one AWS Managed Microsoft AD user into anoth - * To use user and group management or AWS Directory Service Data CLI, it must be enabled. For more information, see [Enable user and group management or Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). + * Enable [user and group management for Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). @@ -17,3 +17 @@ You can copy group memberships from one AWS Managed Microsoft AD user into anoth - * You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). - - * You'll need the necessary IAM permissions to use AWS Directory Service Data. For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html). To get started granting permissions to your users and workloads, you can use AWS managed policies like [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). + * You'll need the necessary IAM permissions to use AWS Directory Service Data. To get started, you can use the [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html) and [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies).