AWS res documentation change
Summary
Updated parameter descriptions and terminology for Active Directory, clarified break-glass user functionality, improved grammar and consistency in deployment instructions
Security assessment
The change enhances documentation of security features by explicitly labeling the AdministratorEmail as a 'break-glass (emergency access) user' for SSO failure scenarios. However, there's no evidence of a specific security vulnerability being addressed. Other changes are grammatical improvements and terminology updates (e.g., 'sudoer access' to 'sudo access') without security implications.
Diff
diff --git a/res/archive/release-minus-1/ug/launch-the-product.md b/res/archive/release-minus-1/ug/launch-the-product.md index b4ef00047..84770636b 100644 --- a//res/archive/release-minus-1/ug/launch-the-product.md +++ b//res/archive/release-minus-1/ug/launch-the-product.md @@ -31 +31 @@ To deploy in AWS GovCloud (US-West), launch this [ template](https://console.ama - 3. The template launches in the US East (N. Virginia) Region by default. To launch the solution in a different AWS Region, use the Region selector in the console navigation bar. + 3. The template launches in the US East (N. Virginia) Region by default. To launch the product in a different AWS Region, use the Region selector in the console navigation bar. @@ -42,2 +42,2 @@ EnvironmentName | `<_res-demo_ >` | A unique name given to your RES environment -AdministratorEmail | | The email address for the user completing setup of the product. This user additionally functions as a break-glass user if there is an active directory single sign on integration failure. -InfrastructureHostAMI | ami-`[numbers or letters only]` | _(Optional)_ You may provide a custom AMI id to use for all the infrastructure hosts. The current supported OSes are Amazon Linux 2, Amazon Linux 2023, RHEL8, RHEL9, Windows Server 2019 and 2022 (x86), and Windows 10 and 11. For more information, see [Prepare Amazon Machine Images (AMIs)](./prerequisites.html#prep-ami). +AdministratorEmail | | The email address for the user completing setup of the product. This user additionally functions as a break-glass (emergency access) user if there is an Active Directory single sign-on integration failure. +InfrastructureHostAMI | ami-`[numbers or letters only]` | _(Optional)_ You can provide a custom AMI ID to use for all the infrastructure hosts. The current supported OSes are Amazon Linux 2, Amazon Linux 2023, RHEL8, RHEL9, Windows Server 2019 and 2022 (x86), and Windows 10 and 11. For more information, see [Prepare Amazon Machine Images (AMIs)](./prerequisites.html#prep-ami). @@ -45 +45 @@ SSHKeyPair | | The key pair used to connect to infrastructure hosts. -ClientIP | `x.x.x`.0/24 or `x.x.x`.0/32 | IP address filter which limits connection to the system. You can update the ClientIpCidr after deployment. +ClientIP | `x.x.x`.0/24 or `x.x.x`.0/32 | IP address filter that limits connections to the system. You can update the ClientIpCidr after deployment. @@ -47 +47 @@ ClientPrefixList | | _(Optional)_ Provide a managed prefix list for IPs allowed -IAMPermissionBoundary | | _(Optional)_ You may provide a managed policy ARN that will be attached as a permission boundary to all roles created in RES. For more information, see [Setting custom permission boundaries](./permission-boundaries.html). +IAMPermissionBoundary | | _(Optional)_ You can provide a managed policy ARN that will be attached as a permission boundary to all roles created in RES. For more information, see [Setting custom permission boundaries](./permission-boundaries.html). @@ -55,2 +55,2 @@ VdiSubnets | | Select at least two private subnets in different Availability Zo -ActiveDirectoryName | ``corp.res.com`` | Domain for the active directory. It does not need to match the portal domain name. -ADShortName | ``corp`` | The short name for the active directory. This is also called the NetBIOS name. +ActiveDirectoryName | ``corp.res.com`` | Domain for the Active Directory. It does not need to match the portal domain name. +ADShortName | ``corp`` | The short name for the Active Directory. This is also called the NetBIOS name. @@ -58,2 +58,2 @@ LDAP Base | ``DC=corp,DC=res,DC=com`` | An LDAP path to the base within the LDAP -LDAPConnectionURI | | A single ldap:// path that can be reached by the active directory's host server. If you deployed the automated external resources with the default AD domain, you can use ldap://corp.res.com. -ServiceAccountCredentialsSecretArn | | Provide a Secret ARN which contains the username and password for the Active Directory ServiceAccount user, formatted as a username:password key/value pair. +LDAPConnectionURI | | A single ldap:// path that points to the Active Directory host server. If you deployed the automated external resources with the default AD domain, you can use ldap://corp.res.com. +ServiceAccountCredentialsSecretArn | | Provide a Secret ARN which contains the username and password for the Active Directory service account user, formatted as a username:password key/value pair. @@ -62 +62 @@ GroupsOU | | Organizational unit within AD for groups that will sync. -SudoersGroupName | RESAdministrators | Group name that contains all users with sudoer access on instances at install and administrator access on RES. +SudoersGroupName | RESAdministrators | Group name that contains all users with sudo access on instances at install and administrator access on RES. @@ -71 +71 @@ CustomDomainNameforVDI | | _(Optional)_ Subdomain used by the web portal to pro -ACMCertificateARNforWebApp | | _(Optional)_ When using the default configuration, the product hosts the web application under the domain amazonaws.com. You may host the product services under your domain. If you deployed the automated external resources, this was generated for you and the information can be found in the Outputs of the res-bi stack. If you need to generate a certificate for your web application, see [Configuration guide](./configuration-guide.html). +ACMCertificateARNforWebApp | | _(Optional)_ When using the default configuration, the product hosts the web application under the domain amazonaws.com. You can host the product services under your domain. If you deployed the automated external resources, this was generated for you and the information can be found in the Outputs of the res-bi stack. If you need to generate a certificate for your web application, see [Configuration guide](./configuration-guide.html). @@ -77 +77 @@ CognitoUserPoolDomainUrl | | Cognito user pool domain for managed login. This - 5. Under **Configure stack options → Tags -_optional_** , add the tags (key-value pairs) you want to apply to RES deployed resources. Tag key `Name` and `res:*` are preserved by RES and could not be used as tag key. + 5. Under **Configure stack options → Tags -_optional_** , add the tags (key-value pairs) you want to apply to RES deployed resources. Tag key `Name` and `res:*` are preserved by RES and cannot be used as tag keys. @@ -84 +84 @@ CognitoUserPoolDomainUrl | | Cognito user pool domain for managed login. This -You can view the status of the stack in the AWS CloudFormation console in the **Status** column. You should receive a CREATE_COMPLETE status in approximately 60 minutes. +You can view the status of the stack in the AWS CloudFormation console in the **Status** column. You receive a CREATE_COMPLETE status in approximately 60 minutes. @@ -88 +88 @@ You can view the status of the stack in the AWS CloudFormation console in the ** -You are responsible for patching your infra / VDI hosts after deployment. +You are responsible for patching your infrastructure/VDI hosts after deployment.