AWS deadline-cloud documentation change
Summary
Clarified permission inheritance rules: farm-level permissions cannot be reduced by queue/fleet assignments
Security assessment
Enhanced documentation of existing security feature (RBAC inheritance). Clarifies critical security behavior: higher-level permissions always override lower-level restrictions, preventing accidental permission reduction. No vulnerability fix indicated.
Diff
diff --git a/deadline-cloud/latest/userguide/membership-inheritance.md b/deadline-cloud/latest/userguide/membership-inheritance.md index d88c8d021..b8701699a 100644 --- a//deadline-cloud/latest/userguide/membership-inheritance.md +++ b//deadline-cloud/latest/userguide/membership-inheritance.md @@ -21 +21 @@ For example, if you assign a user as a Contributor at the farm level, that user -You can also assign membership at the queue or fleet level for more granular access control. Queue-level and fleet-level membership only applies to that specific resource. +You can assign membership at the queue or fleet level to grant access to specific resources. Queue-level and fleet-level membership applies only to that resource. @@ -29 +29 @@ Users can have access to only a queue or fleet without having farm-level members -When a user has membership at multiple levels, Deadline Cloud uses the highest access level. For example: +When a user has membership at multiple levels, Deadline Cloud applies the highest access level. Lower-level assignments cannot reduce farm-level permissions. For example: @@ -33 +33 @@ When a user has membership at multiple levels, Deadline Cloud uses the highest a - * A user with Contributor access at the farm level and Owner access on a specific fleet has Owner permissions on that fleet and Contributor permissions elsewhere. + * A user with Owner access at the farm level retains Owner permissions on any queue, even if that queue has a Viewer-level assignment.