AWS security-ir documentation change
Summary
Updated CloudFormation template documentation to clarify containment roles and differentiate between containment-only vs containment with EC2 Triage templates
Security assessment
The changes explicitly document security incident response roles and permissions (including EC2 Triage capabilities) but do not address a specific security vulnerability. The documentation improvements help users understand security features.
Diff
diff --git a/security-ir/latest/userguide/cloudformation-templates.md b/security-ir/latest/userguide/cloudformation-templates.md index e97c3fb89..176366697 100644 --- a//security-ir/latest/userguide/cloudformation-templates.md +++ b//security-ir/latest/userguide/cloudformation-templates.md @@ -7 +7 @@ -# CloudFormation templates +# Select a CloudFormation template for your containment roles @@ -9 +9 @@ -The following templates create the necessary IAM roles for AWS Security Incident Response containment actions. Choose the template that best fits your security requirements. +AWS Security Incident Response provides two AWS CloudFormation templates. Both templates create the same two AWS Identity and Access Management roles: `AWSSecurityIncidentResponseContainment` and `AWSSecurityIncidentResponseContainmentExecution`. The **Containment with EC2 Triage** template adds the `AWSSecurityIncidentResponseInvestigationPolicy` to the `AWSSecurityIncidentResponseContainment` role, which grants additional permissions for EC2 Triage. Choose the template that matches your security requirements: @@ -11 +11 @@ The following templates create the necessary IAM roles for AWS Security Incident -###### Contents + * [Containment only](./containment-only-template.html): Creates the minimum required permissions for containment actions. @@ -13,3 +13 @@ The following templates create the necessary IAM roles for AWS Security Incident - * [Containment only](./containment-only-template.html) - - * [Containment with EC2 Triage](./containment-with-ec2-triage-template.html) + * [Containment with EC2 Triage](./containment-with-ec2-triage-template.html): Includes all containment permissions plus additional permissions for EC2 Triage. This template enables AWS Security Incident Response to execute AWS Systems Manager Run Command on your Amazon Elastic Compute Cloud instances during security investigations. @@ -26 +24 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Working with CloudFormation StackSets +Deploy the IAM roles with a StackSet