AWS directoryservice documentation change
Summary
Updated documentation for creating AWS Managed Microsoft AD groups: removed references to 'user and group management', clarified prerequisites including enabling features only from Primary Region, simplified IAM permission guidance with direct links to managed policies, improved CLI/PowerShell command examples, and added reference links.
Security assessment
The changes enhance security documentation by emphasizing Primary Region enforcement for enabling features (preventing misconfiguration in non-primary regions) and strengthening IAM guidance with direct references to managed policies like AWSDirectoryServiceDataFullAccess. However, there's no evidence of addressing a specific vulnerability, as these are general documentation improvements for security best practices.
Diff
diff --git a/directoryservice/latest/admin-guide/ms_ad_create_group.md b/directoryservice/latest/admin-guide/ms_ad_create_group.md index 47306d846..90838a836 100644 --- a//directoryservice/latest/admin-guide/ms_ad_create_group.md +++ b//directoryservice/latest/admin-guide/ms_ad_create_group.md @@ -9 +9 @@ -Use the following procedure to create an AWS Managed Microsoft AD group with user and group management or AWS Directory Service Data in either the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. +Use the following procedure to create an AWS Managed Microsoft AD group with AWS Directory Service Data in the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. @@ -11 +11 @@ Use the following procedure to create an AWS Managed Microsoft AD group with use -###### Before you begin either procedure, you need to complete the following: +###### Before you begin, complete the following: @@ -15 +15 @@ Use the following procedure to create an AWS Managed Microsoft AD group with use - * To use user and group management or AWS Directory Service Data CLI, it must be enabled. For more information, see [Enable user and group management or Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). + * Enable [user and group management for Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). @@ -17,3 +17 @@ Use the following procedure to create an AWS Managed Microsoft AD group with use - * You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). - - * You'll need the necessary IAM permissions to use AWS Directory Service Data. For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html). To get started granting permissions to your users and workloads, you can use AWS managed policies like [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). + * You'll need the necessary IAM permissions to use AWS Directory Service Data. To get started, you can use the [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html) and [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). @@ -93 +91 @@ The following describes how to format a request that creates an AWS Managed Micr - * Open the AWS CLI, and run the following command, replacing the Directory ID, username and group display name with your AWS Managed Microsoft AD Directory ID, username, and desired group display name: + * Open the AWS CLI, and run the following command with your Directory ID, group name, and display name: @@ -103 +101 @@ The following describes how to format a request that creates an AWS Managed Micr - "DisplayName": { "S": "myGroupDisplayName"} + "DisplayName": { "S": "myGroupDisplayName"}, @@ -107 +105,3 @@ The following describes how to format a request that creates an AWS Managed Micr -AWS Tools for PowerShell +For more information, see [`create-group`](https://docs.aws.amazon.com//cli/latest/reference/ds-data/create-group.html). + +PowerShell @@ -114 +114 @@ The following describes how to format a request that creates an AWS Managed Micr - * Open PowerShell, and run the following command, replacing the Directory ID, username and group display name with your AWS Managed Microsoft AD Directory ID, username, and desired group display name: + * Open PowerShell, and run the following command with your Directory ID, group name, and display name: @@ -127,0 +128,2 @@ The following describes how to format a request that creates an AWS Managed Micr +For more information, see [`New-DSDGroup`](https://docs.aws.amazon.com//powershell/latest/reference/items/New-DSDGroup.html). +