AWS directoryservice documentation change
Summary
Updated documentation for managing AWS Managed Microsoft AD group memberships. Changes include: clarified procedures for adding/removing users/groups, streamlined prerequisites, updated CLI/PowerShell examples with multi-line syntax and parameter explanations, added command reference links, and removed redundant content.
Security assessment
The changes are editorial improvements focusing on clarity and usability. No security vulnerabilities or incidents are addressed. While IAM permission requirements are mentioned, this is standard operational guidance rather than new security documentation. The updates refine existing security practices without introducing new security features.
Diff
diff --git a/directoryservice/latest/admin-guide/ms_ad_add_remove_user_group.md b/directoryservice/latest/admin-guide/ms_ad_add_remove_user_group.md index b3e58f5cc..290b50930 100644 --- a//directoryservice/latest/admin-guide/ms_ad_add_remove_user_group.md +++ b//directoryservice/latest/admin-guide/ms_ad_add_remove_user_group.md @@ -13 +13 @@ With the [AWS Directory Service Data API](https://docs.aws.amazon.com/directorys -Use the following procedures to add or remove an AWS Managed Microsoft AD user to a group or group to another group with user and group management or AWS Directory Service Data in either the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. +Use the following procedures to manage group membership for AWS Managed Microsoft AD users and groups with AWS Directory Service Data in the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. @@ -17 +17 @@ Use the following procedures to add or remove an AWS Managed Microsoft AD user t -Use the following procedure to add an AWS Managed Microsoft AD user to a group with user and group management or AWS Directory Service Data in either the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. +Use the following procedure to add an AWS Managed Microsoft AD user to a group with AWS Directory Service Data in the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. @@ -21 +21 @@ Use the following procedure to add an AWS Managed Microsoft AD user to a group w -When you add an AWS Managed Microsoft AD user to a group, the user inherits the roles and permissions assigned to the group. These roles and permissions are part of the user's group memberships. +When you add an AWS Managed Microsoft AD user to a group, the user inherits the roles and permissions assigned to the group. @@ -23 +23 @@ When you add an AWS Managed Microsoft AD user to a group, the user inherits the -###### Before you begin either procedure, you need to complete the following: +###### Before you begin, complete the following: @@ -27 +27 @@ When you add an AWS Managed Microsoft AD user to a group, the user inherits the - * To use user and group management or AWS Directory Service Data CLI, it must be enabled. For more information, see [Enable user and group management or Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). + * Enable [user and group management for Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). @@ -29,3 +29 @@ When you add an AWS Managed Microsoft AD user to a group, the user inherits the - * You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). - - * You'll need the necessary IAM permissions to use AWS Directory Service Data. For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html). To get started granting permissions to your users and workloads, you can use AWS managed policies like [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). + * You'll need the necessary IAM permissions to use AWS Directory Service Data. To get started, you can use the [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html) and [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). @@ -73 +71,2 @@ The following describes how to format a request that adds an AWS Managed Microso - * To add a user to a group, open the AWS CLI, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID and group and member names: + * To add a user to a group, open the AWS CLI, and run the following command with your Directory ID, group name, and member name: + @@ -77,0 +77,4 @@ The following describes how to format a request that adds an AWS Managed Microso + aws ds-data add-group-member \ + --directory-id d-1234567890 \ + --group-name "your-group-name" \ + --member-name "jane.doe" @@ -79 +82 @@ The following describes how to format a request that adds an AWS Managed Microso - aws ds-data add-group-member --directory-id d-1234567890 --group-name "your-group-name" --member-name "jane.doe" +For more information, see [`add-group-member`](https://docs.aws.amazon.com//cli/latest/reference/ds-data/add-group-member.html). @@ -81 +84 @@ The following describes how to format a request that adds an AWS Managed Microso -AWS Tools for PowerShell +PowerShell @@ -88 +91,2 @@ The following describes how to format a request that adds an AWS Managed Microso - * To add a user to a group, open the PowerShell, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID and group and member names: + * To add a user to a group, open PowerShell, and run the following command with your Directory ID, group name, and member name: + @@ -92,0 +97,4 @@ The following describes how to format a request that adds an AWS Managed Microso + Add-DSDGroupMember ` + -DirectoryId d-1234567890 ` + -GroupName "your-group-name" ` + -MemberName "jane.doe" @@ -94 +102 @@ The following describes how to format a request that adds an AWS Managed Microso - Add-DSDGroupMember -DirectoryId d-1234567890 -GroupName "your-group-name" -MemberName "jane.doe" +For more information, see [`Add-DSDGroupMember`](https://docs.aws.amazon.com//powershell/latest/reference/items/Add-DSDGroupMember.html). @@ -100 +108 @@ With the [AWS Directory Service Data API](https://docs.aws.amazon.com/directorys -Use the following procedure to remove an AWS Managed Microsoft AD user to a group with user and group management or AWS Directory Service Data in either the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. +Use the following procedure to remove an AWS Managed Microsoft AD user from a group with AWS Directory Service Data in the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. @@ -104,18 +112 @@ Use the following procedure to remove an AWS Managed Microsoft AD user to a grou -When you remove an AWS Managed Microsoft AD user from a group, the user loses access to the roles and permissions assigned to the group. These roles and permissions are part of the group's memberships. - -###### Before you begin either procedure, you need to complete the following: - - * [Creating your AWS Managed Microsoft AD](./ms_ad_getting_started.html#ms_ad_getting_started_create_directory). - - * To use user and group management or AWS Directory Service Data CLI, it must be enabled. For more information, see [Enable user and group management or Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). - - * You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). - - * You'll need the necessary IAM permissions to use AWS Directory Service Data. For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html). To get started granting permissions to your users and workloads, you can use AWS managed policies like [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). - - * [Create an AWS Managed Microsoft AD user](./ms_ad_create_user.html). - - * [Create an AWS Managed Microsoft AD group](./ms_ad_create_group.html). - - - +When you remove an AWS Managed Microsoft AD user from a group, the user loses the roles and permissions assigned to the group. @@ -156 +147,2 @@ The following describes how to format a request that removes an AWS Managed Micr - * To remove a user to a group, open the AWS CLI, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID, group and member names: + * To remove a user from a group, open the AWS CLI, and run the following command with your Directory ID, group name, and member name: + @@ -160,0 +153,4 @@ The following describes how to format a request that removes an AWS Managed Micr + aws ds-data remove-group-member \ + --directory-id d-1234567890 \ + --group-name "your-group-name" \ + --member-name "jane.doe" @@ -162 +158 @@ The following describes how to format a request that removes an AWS Managed Micr - aws ds-data remove-group-member --directory-id d-1234567890 --group-name "your-group-name" --member-name "jane.doe" +For more information, see [`remove-group-member`](https://docs.aws.amazon.com//cli/latest/reference/ds-data/remove-group-member.html). @@ -164 +160 @@ The following describes how to format a request that removes an AWS Managed Micr -AWS Tools for PowerShell +PowerShell @@ -171 +167 @@ The following describes how to format a request that removes an AWS Managed Micr - * To remove a user to a group, open the PowerShell, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID, group and member names: + * To remove a user from a group, open PowerShell, and run the following command with your Directory ID, group name, and member name: @@ -177 +173,6 @@ The following describes how to format a request that removes an AWS Managed Micr - Remove-DSDGroupMember -DirectoryId d-1234567890 -GroupName "your-group-name" -MemberName "jane.doe" + Remove-DSDGroupMember ` + -DirectoryId d-1234567890 ` + -GroupName "your-group-name" ` + -MemberName "jane.doe" + +For more information, see [`Remove-DSDGroupMember`](https://docs.aws.amazon.com//powershell/latest/reference/items/Remove-DSDGroupMember.html). @@ -183,15 +183,0 @@ When you add an AWS Managed Microsoft AD group to another group, the groups shar -###### Before you begin either procedure, you need to complete the following: - - * [Creating your AWS Managed Microsoft AD](./ms_ad_getting_started.html#ms_ad_getting_started_create_directory). - - * To use user and group management or AWS Directory Service Data CLI, it must be enabled. For more information, see [Enable user and group management or Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). - - * You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). - - * You'll need the necessary IAM permissions to use AWS Directory Service Data. For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html). To get started granting permissions to your users and workloads, you can use AWS managed policies like [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). - - * [Create an AWS Managed Microsoft AD group](./ms_ad_create_group.html). - - - - @@ -252 +238,2 @@ The following describes how to format a request that adds an AWS Managed Microso - * To add a child group to a parent group, open the AWS CLI, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID, group and member names: + * To add a child group to a parent group, open the AWS CLI, and run the following command with your Directory ID, group name, and member name: + @@ -256,0 +244,4 @@ The following describes how to format a request that adds an AWS Managed Microso + aws ds-data add-group-member \ + --directory-id d-1234567890 \ + --group-name "parent-group-name" \ + --member-name "child-group-name" @@ -258 +249 @@ The following describes how to format a request that adds an AWS Managed Microso - aws ds-data add-group-member --directory-id d-1234567890 --group-name "parent-group-name" --member-name "child-group-name" +For more information, see [`add-group-member`](https://docs.aws.amazon.com//cli/latest/reference/ds-data/add-group-member.html). @@ -260 +251 @@ The following describes how to format a request that adds an AWS Managed Microso -AWS Tools for PowerShell +PowerShell @@ -267 +258,2 @@ The following describes how to format a request that adds an AWS Managed Microso - * To add a child group to a parent group, open the PowerShell, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID, group and member names: + * To add a child group to a parent group, open PowerShell, and run the following command with your Directory ID, group name, and member name: + @@ -271,0 +264,4 @@ The following describes how to format a request that adds an AWS Managed Microso + Add-DSDGroupMember ` + -DirectoryId d-1234567890 ` + -GroupName "parent-group-name" ` + -MemberName "child-group-name" @@ -273 +269 @@ The following describes how to format a request that adds an AWS Managed Microso - Add-DSDGroupMember -DirectoryId d-1234567890 -GroupName "parent-group-name" -MemberName "child-group-name" +For more information, see [`Add-DSDGroupMember`](https://docs.aws.amazon.com//powershell/latest/reference/items/Add-DSDGroupMember.html). @@ -279,15 +274,0 @@ When you remove an AWS Managed Microsoft AD group from another group, the groups -###### Before you begin either procedure, you need to complete the following: - - * [Creating your AWS Managed Microsoft AD](./ms_ad_getting_started.html#ms_ad_getting_started_create_directory). - - * To use user and group management or AWS Directory Service Data CLI, it must be enabled. For more information, see [Enable user and group management or Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). - - * You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). - - * You'll need the necessary IAM permissions to use AWS Directory Service Data. For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html). To get started granting permissions to your users and workloads, you can use AWS managed policies like [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). - - * [Create an AWS Managed Microsoft AD group](./ms_ad_create_group.html). - - - - @@ -297 +278 @@ AWS Management Console -You can remove an AWS Managed Microsoft AD group to a group with the AWS Management Console. +You can remove an AWS Managed Microsoft AD group from a group with the AWS Management Console. @@ -344 +325 @@ AWS CLI -The following describes how to format a request that removes an AWS Managed Microsoft AD group to a group with the AWS Directory Service Data CLI. +The following describes how to format a request that removes an AWS Managed Microsoft AD group from a group with the AWS Directory Service Data CLI. @@ -348 +329 @@ The following describes how to format a request that removes an AWS Managed Micr -To add remove a child group from a parent group, open the AWS CLI, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID, group and member names: +To remove a child group from a parent group, open the AWS CLI, and run the following command with your Directory ID, group name, and member name: @@ -354 +335,4 @@ To add remove a child group from a parent group, open the AWS CLI, and run the f - aws ds-data remove-group-member --directory-id d-1234567890 --group-name "parent-group-name" --member-name "child-group-name" + aws ds-data remove-group-member \ + --directory-id d-1234567890 \ + --group-name "parent-group-name" \ + --member-name "child-group-name" @@ -356 +340 @@ To add remove a child group from a parent group, open the AWS CLI, and run the f -AWS Tools for PowerShell +For more information, see [`remove-group-member`](https://docs.aws.amazon.com//cli/latest/reference/ds-data/remove-group-member.html). @@ -357,0 +342 @@ AWS Tools for PowerShell +PowerShell @@ -359 +344,2 @@ AWS Tools for PowerShell -The following describes how to format a request that removes an AWS Managed Microsoft AD group to a group with AWS Tools for PowerShell. + +The following describes how to format a request that removes an AWS Managed Microsoft AD group from a group with AWS Tools for PowerShell. @@ -363 +349,2 @@ The following describes how to format a request that removes an AWS Managed Micr -To add remove a child group from a parent group, open the PowerShell, and run the following command, replacing the Directory ID, group and member names with your AWS Managed Microsoft AD Directory ID, group and member names: +To remove a child group from a parent group, open the PowerShell, and run the following command with your Directory ID, group name, and member name: + @@ -367,0 +355,4 @@ To add remove a child group from a parent group, open the PowerShell, and run th + Remove-DSDGroupMember ` + -DirectoryId d-1234567890 ` + -GroupName "parent-group-name" ` + -MemberName "child-group-name" @@ -369 +360 @@ To add remove a child group from a parent group, open the PowerShell, and run th - Remove-DSDGroupMember -DirectoryId d-1234567890 -GroupName "parent-group-name" -MemberName "child-group-name" +For more information, see [`Remove-DSDGroupMember`](https://docs.aws.amazon.com//powershell/latest/reference/items/Remove-DSDGroupMember.html).