AWS directoryservice documentation change
Summary
Updated documentation for creating AWS Managed Microsoft AD users: clarified prerequisites, improved IAM permission guidance, fixed typos, and added CLI/PowerShell reference links.
Security assessment
Changes focus on documentation clarity and accuracy updates. The IAM permissions section was condensed but doesn't introduce new security concepts or address vulnerabilities. No evidence of security incident remediation.
Diff
diff --git a/directoryservice/latest/admin-guide/ms_ad_create_user.md b/directoryservice/latest/admin-guide/ms_ad_create_user.md index 01d09d9f6..c19852e8d 100644 --- a//directoryservice/latest/admin-guide/ms_ad_create_user.md +++ b//directoryservice/latest/admin-guide/ms_ad_create_user.md @@ -9 +9 @@ -Use the following procedure to create a new AWS Managed Microsoft AD user with user and group management or AWS Directory Service Data in either the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. +Use the following procedure to create a new AWS Managed Microsoft AD user with AWS Directory Service Data in the AWS Management Console, AWS CLI, or AWS Tools for PowerShell. @@ -11 +11 @@ Use the following procedure to create a new AWS Managed Microsoft AD user with u -###### Before you begin either procedure, you need to complete the following: +###### Before you begin, complete the following: @@ -13 +13 @@ Use the following procedure to create a new AWS Managed Microsoft AD user with u - * To use user and group management or AWS Directory Service Data CLI, it must be enabled. For more information, see [Enable user and group management or Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). + * Enable [user and group management for Directory Service Data](./ms_ad_users_groups_mgmt_enable_disable.html). You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). @@ -15,3 +15 @@ Use the following procedure to create a new AWS Managed Microsoft AD user with u - * You can only enable this feature from the Primary AWS Region for your directory. For more information, see [Primary vs additional Regions](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/multi-region-global-primary-additional.html). - - * You'll need the necessary IAM permissions to use AWS Directory Service Data. For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html). To get started granting permissions to your users and workloads, you can use AWS managed policies like [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). + * You'll need the necessary IAM permissions to use AWS Directory Service Data. To get started, you can use the [AWS managed policy: AWSDirectoryServiceDataFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataFullAccess) or [AWS managed policy: AWSDirectoryServiceDataReadOnlyAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSDirectoryServiceDataReadOnlyAccess). For more information, see [Directory Service API permissions: Actions, resources, and conditions reference](./UsingWithDS_IAM_ResourcePermissions.html) and [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies). @@ -87 +85 @@ For more information on user attributes, see [AWS Directory Service Data attribu - 13. After the user is configured, you've taken to the new user's details page. A banner appears stating the user was successfully created. + 13. After the user is configured, you're taken to the new user's details page. A banner appears stating the user was successfully created. @@ -103 +101 @@ The following describes how to format a request that creates a new AWS Managed M - * Open the AWS CLI, and run the following command, replacing the Directory ID, username, and display name with your AWS Managed Microsoft AD Directory ID and desired credentials: + * Open the AWS CLI, and run the following command with your Directory ID, username, and display name: @@ -117 +115,3 @@ The following describes how to format a request that creates a new AWS Managed M -AWS Tools for PowerShell +For more information, see [`create-user`](https://docs.aws.amazon.com//cli/latest/reference/ds-data/create-user.html). + +PowerShell @@ -124 +124 @@ The following describes how to format a request that creates a new AWS Managed M - * Open PowerShell, and run the following command, replacing the Directory ID, username, and display name with your AWS Managed Microsoft AD Directory ID and desired credentials: + * Open PowerShell, and run the following command with your Directory ID, username, and display name: @@ -137,0 +138,2 @@ The following describes how to format a request that creates a new AWS Managed M +For more information, see [`New-DSDUser`](https://docs.aws.amazon.com//powershell/latest/reference/items/New-DSDUser.html). +