AWS aurora-dsql medium security documentation change
Summary
Complete rewrite of IAM condition keys documentation: replaced region-based examples with new sections on restricting witness regions, requiring tags, and restricting fault injections using service-specific condition keys.
Security assessment
The changes add documentation for security-focused condition keys (dsql:WitnessRegion, dsql:FisActionId, dsql:FisTargetArns) that enable granular access control. Specifically, it demonstrates restricting fault injections (security vulnerability prevention) and witness region configurations (security boundary enforcement), providing concrete security controls.
Diff
diff --git a/aurora-dsql/latest/userguide/using-iam-condition-keys.md b/aurora-dsql/latest/userguide/using-iam-condition-keys.md index e749ce0ba..42a389a92 100644 --- a//aurora-dsql/latest/userguide/using-iam-condition-keys.md +++ b//aurora-dsql/latest/userguide/using-iam-condition-keys.md @@ -7 +7 @@ -Create a cluster in a specific RegionCreate a multi-Region cluster in specific RegionsCreate a multi-Region cluster with specific witness Region +Available condition keysRestrict witness RegionRequire tags on createRestrict fault injection @@ -11 +11 @@ Create a cluster in a specific RegionCreate a multi-Region cluster in specific R -When you grant permissions in Aurora DSQL you can specify conditions that determine how a permissions policy takes effect. The following are examples of how you can use condition keys in Aurora DSQL permissions policies. +The `Condition` element (or `Condition` block) specifies the conditions under which a policy statement is in effect. You build conditional expressions using [condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) such as `StringEquals` or `StringLike` to match keys in the policy against values in the request. Condition keys are different from resource ARN scoping, which restricts actions to specific resources using the `Resource` element. @@ -13 +13 @@ When you grant permissions in Aurora DSQL you can specify conditions that determ -## Example 1: Grant permission to create a cluster in a specific AWS Region +Amazon Aurora DSQL supports both service-specific condition keys and AWS global condition keys. You can use these keys to refine the conditions under which your IAM policy statements apply. For more information about AWS global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the _IAM User Guide_. @@ -15 +15,7 @@ When you grant permissions in Aurora DSQL you can specify conditions that determ -The following policy grants permission to create clusters in the US East (N. Virginia) and US East (Ohio) Regions. This policy uses the resource ARN to limit the allowed Regions, so Aurora DSQL can only create clusters only if that ARN is specified in the `Resource` section of the policy. +## Available condition keys for Amazon Aurora DSQL + +Amazon Aurora DSQL supports the service-specific condition keys `dsql:WitnessRegion`, `dsql:FisActionId`, and `dsql:FisTargetArns`. You can also use AWS global condition keys such as `aws:RequestTag`, `aws:ResourceTag`, and `aws:TagKeys`. For a complete list of Amazon Aurora DSQL actions, condition keys, and resources that you can specify in policies, see [Actions, resources, and condition keys for Amazon Aurora DSQL](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonauroradsql.html#amazonauroradsql-policy-keys) in the _Service Authorization Reference_. + +## Example: Restrict the witness Region for multi-Region clusters + +The following policy uses the `dsql:WitnessRegion` condition key to restrict multi-Region cluster creation to cases where the witness Region is US West (Oregon). Without this condition, you can specify any Region as the witness Region. @@ -28,4 +34,19 @@ JSON - "Action": ["dsql:CreateCluster"], - "Resource": [ - "arn:aws:dsql:us-east-1:*:cluster/*", - "arn:aws:dsql:us-east-2:*:cluster/*" + "Sid": "AllowCreateWithSpecificWitness", + "Effect": "Allow", + "Action": [ + "dsql:CreateCluster", + "dsql:PutWitnessRegion" + ], + "Resource": "arn:aws:dsql:*:123456789012:cluster/*", + "Condition": { + "StringEquals": { + "dsql:WitnessRegion": "us-west-2" + } + } + }, + { + "Sid": "AllowMultiRegionSetup", + "Effect": "Allow", + "Action": [ + "dsql:PutMultiRegionProperties", + "dsql:AddPeerCluster" @@ -33 +54 @@ JSON - "Effect": "Allow" + "Resource": "arn:aws:dsql:*:123456789012:cluster/*" @@ -39 +60 @@ JSON -## Example 2: Grant permission to create a multi-Region cluster in specific AWS Regions +The first statement applies the `dsql:WitnessRegion` condition to the actions that support it (`dsql:CreateCluster` and `dsql:PutWitnessRegion`). The second statement grants `dsql:PutMultiRegionProperties` and `dsql:AddPeerCluster` without the condition, because the `dsql:WitnessRegion` condition key applies only to `dsql:CreateCluster` and `dsql:PutWitnessRegion`. @@ -41 +62,3 @@ JSON -The following policy grants permission to create multi-Region clusters in the US East (N. Virginia) and US East (Ohio) Regions. This policy uses the resource ARN to limit the allowed Regions, so Aurora DSQL can create multi-Region clusters only if this ARN is specified in the `Resource` section of the policy. Note that creating multi-Region clusters also requires the `PutMultiRegionProperties`, `PutWitnessRegion`, and `AddPeerCluster` permissions in each specified Region. +## Example: Require tags when creating clusters + +The following policy uses the `aws:RequestTag` and `aws:TagKeys` condition keys to require an `Environment` tag when you create clusters. @@ -53,0 +77 @@ JSON + "Sid": "AllowCreateWithRequiredTag", @@ -55,9 +79,8 @@ JSON - "Action": [ - "dsql:CreateCluster", - "dsql:PutMultiRegionProperties", - "dsql:PutWitnessRegion", - "dsql:AddPeerCluster" - ], - "Resource": [ - "arn:aws:dsql:us-east-1:123456789012:cluster/*", - "arn:aws:dsql:us-east-2:123456789012:cluster/*" + "Action": "dsql:CreateCluster", + "Resource": "arn:aws:dsql:*:123456789012:cluster/*", + "Condition": { + "StringEquals": { + "aws:RequestTag/Environment": [ + "production", + "staging", + "development" @@ -64,0 +88,8 @@ JSON + }, + "ForAllValues:StringEquals": { + "aws:TagKeys": [ + "Environment", + "Owner" + ] + } + } @@ -70 +101,3 @@ JSON -## Example 3: Grant permission to create a multi-Region cluster with a specific witness Region +This policy uses two condition keys together. The `aws:RequestTag/Environment` condition requires that the `Environment` tag has one of the allowed values. The `aws:TagKeys` condition with the `ForAllValues` set operator ensures that the request includes only the `Environment` and `Owner` tag keys. + +## Example: Restrict fault injection to specific clusters @@ -72 +105 @@ JSON -The following policy uses an Aurora DSQL `dsql:WitnessRegion` condition key and lets a user create multi-Region clusters with a witness Region in US West (Oregon). If you don't specify the `dsql:WitnessRegion` condition, you can use any Region as the witness Region. +The following policy uses the `dsql:FisActionId` and `dsql:FisTargetArns` condition keys to restrict AWS FIS fault injection to a specific action and target cluster. @@ -85 +118 @@ JSON - "Sid": "AllowCreateWithSpecificWitness", + "Sid": "AllowSpecificFaultInjection", @@ -87,5 +120,2 @@ JSON - "Action": [ - "dsql:CreateCluster", - "dsql:PutWitnessRegion" - ], - "Resource": "arn:aws:dsql:*:123456789012:cluster/*", + "Action": "dsql:InjectError", + "Resource": "*", @@ -94 +124,4 @@ JSON - "dsql:WitnessRegion": "us-west-2" + "dsql:FisActionId": "aws:dsql:cluster-connection-failure" + }, + "ForAllValues:ArnLike": { + "dsql:FisTargetArns": "arn:aws:dsql:us-east-1:123456789012:cluster/*" @@ -97,9 +129,0 @@ JSON - }, - { - "Sid": "AllowMultiRegionSetup", - "Effect": "Allow", - "Action": [ - "dsql:PutMultiRegionProperties", - "dsql:AddPeerCluster" - ], - "Resource": "arn:aws:dsql:*:123456789012:cluster/*" @@ -110,0 +135,2 @@ JSON +The `dsql:FisActionId` condition restricts the fault injection actions that you can perform. The `dsql:FisTargetArns` condition uses the `ForAllValues` set operator and the `ArnLike` operator. Together, they ensure that every cluster ARN in the request matches the allowed pattern. This blocks any request that includes cluster ARNs outside the intended scope. +