AWS dcv medium security documentation change
Summary
Replaced 'allow list' terminology with 'device compatibility filter' and added security disclaimer
Security assessment
Explicitly states the USB filter is not a security boundary ('not a security access control'), addressing potential security misconceptions. This change mitigates risks of misconfiguration by clarifying security limitations.
Diff
diff --git a/dcv/latest/adminguide/manage-usb-remote.md b/dcv/latest/adminguide/manage-usb-remote.md index 991859d36..0b99d805f 100644 --- a//dcv/latest/adminguide/manage-usb-remote.md +++ b//dcv/latest/adminguide/manage-usb-remote.md @@ -19 +19 @@ USB remotization is only supported with the Windows client. It's not supported w -The Amazon DCV server uses an allow list to determine which USB devices clients are allowed to use. By default, some commonly used USB devices are added to the allow list. This means clients can connect these USB devices to their computer and use them on the server without any additional configuration. For more information, see [Using USB Remotization](https://docs.aws.amazon.com/dcv/latest/userguide/using-usb.html) in the _Amazon DCV User Guide_ +The Amazon DCV server uses a device compatibility filter to determine which USB devices are recognized for remotization. This filter is not a security access control and should not be relied upon as a security boundary. By default, some commonly used USB devices are included in the device compatibility filter. This means clients can connect these USB devices to their computer and use them on the server without any additional configuration. For more information, see [Using USB Remotization](https://docs.aws.amazon.com/dcv/latest/userguide/using-usb.html) in the _Amazon DCV User Guide_ @@ -21 +21 @@ The Amazon DCV server uses an allow list to determine which USB devices clients -However, some specialized devices might not be added to the allow list by default. These devices must be manually added to the allow list on the Amazon DCV server before they can be used by the client. After they have been added, they appear in the Windows client **Settings** menu. +However, some specialized devices might not be included in the device compatibility filter by default. These devices must be manually added to the filter configuration on the Amazon DCV server before they are recognized for remotization. After they have been added, they appear in the Windows client **Settings** menu. @@ -26 +26 @@ Windows Amazon DCV server -To add a USB device to the allow list, you must obtain the USB device's filter string from the client and add it to the `usb-devices.conf` file. +To add a USB device to the device compatibility filter, you must obtain the USB device's filter string from the client and add it to the `usb-devices.conf` file. @@ -28 +28 @@ To add a USB device to the allow list, you must obtain the USB device's filter s -###### To add a USB device to the allow list on a Windows Amazon DCV server +###### To add a USB device to the device compatibility filter on a Windows Amazon DCV server @@ -54 +54 @@ Linux Amazon DCV server -To add a USB device to the allow list, add the filter string for the USB device to the `usb-devices.conf` file. +To add a USB device to the device compatibility filter, add the filter string for the USB device to the `usb-devices.conf` file. @@ -56 +56 @@ To add a USB device to the allow list, add the filter string for the USB device -###### Adding USB devices to the allow list on a Linux Amazon DCV server +###### Adding USB devices to the device compatibility filter on a Linux Amazon DCV server