AWS devopsagent documentation change
Summary
Updated IAM permissions for AWS DevOps Agent, including restructuring of full access policy, addition of new actions across multiple services, and consolidation of permissions statements.
Security assessment
The changes involve updates to IAM permissions documentation which is inherently security-related, but there is no evidence of addressing a specific vulnerability or incident. Changes include permission additions for services like securityhub, inspector2, and secretsmanager, but these are routine updates to reflect service capabilities rather than patching security flaws.
Diff
diff --git a/devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md b/devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md index a6072e9df..636c4f250 100644 --- a//devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md +++ b//devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md @@ -320,0 +321,2 @@ Provides read only access to Amazon DevOps Agent via the AWS Management Console + "aidevops:DescribePrivateConnection", + "aidevops:DescribeServices", @@ -339,25 +341 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console - "Sid": "AIDevOpsAgentSpaceAccess", - "Effect": "Allow", - "Action": [ - "aidevops:CreateAgentSpace", - "aidevops:DeleteAgentSpace", - "aidevops:GetAgentSpace", - "aidevops:ListAgentSpaces", - "aidevops:UpdateAgentSpace" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsServiceAccess", - "Effect": "Allow", - "Action": [ - "aidevops:DeregisterService", - "aidevops:GetService", - "aidevops:ListServices", - "aidevops:RegisterService", - "aidevops:SearchServiceAccessibleResource" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsAssociationAccess", + "Sid": "AIDevOpsAgentAccess", @@ -365,0 +344 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console + "aidevops:AllowVendedLogDeliveryForResource", @@ -367,31 +346,2 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console - "aidevops:DisassociateService", - "aidevops:GetAssociation", - "aidevops:ListAssociations", - "aidevops:UpdateAssociation", - "aidevops:ValidateAwsAssociations" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsWebhookAccess", - "Effect": "Allow", - "Action": [ - "aidevops:ListWebhooks" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsOperatorAppAccess", - "Effect": "Allow", - "Action": [ - "aidevops:DisableOperatorApp", - "aidevops:EnableOperatorApp", - "aidevops:GetOperatorApp", - "aidevops:UpdateOperatorAppIdpConfig" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsAssetAccess", - "Effect": "Allow", - "Action": [ + "aidevops:CreateAccessToken", + "aidevops:CreateAgentSpace", @@ -399,0 +350,7 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console + "aidevops:CreateBacklogTask", + "aidevops:CreateChat", + "aidevops:CreateKnowledgeItem", + "aidevops:CreateOneTimeLoginSession", + "aidevops:CreatePrivateConnection", + "aidevops:CreateTrigger", + "aidevops:DeleteAgentSpace", @@ -401,0 +359,15 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console + "aidevops:DeleteKnowledgeItem", + "aidevops:DeletePrivateConnection", + "aidevops:DeleteTrigger", + "aidevops:DeregisterService", + "aidevops:DescribePrivateConnection", + "aidevops:DescribeServices", + "aidevops:DescribeSupportLevel", + "aidevops:DisableOperatorApp", + "aidevops:DisassociateService", + "aidevops:DiscoverTopology", + "aidevops:EnableOperatorApp", + "aidevops:EndChatForCase", + "aidevops:GetAccessToken", + "aidevops:GetAccountUsage", + "aidevops:GetAgentSpace", @@ -405 +377,10 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console - "aidevops:ListAssets", + "aidevops:GetAssociation", + "aidevops:GetBacklogTask", + "aidevops:GetKnowledgeItem", + "aidevops:GetOperatorApp", + "aidevops:GetRecommendation", + "aidevops:GetService", + "aidevops:GetTrigger", + "aidevops:InitiateChatForCase", + "aidevops:ListAccessTokens", + "aidevops:ListAgentSpaces", @@ -406,0 +388 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console + "aidevops:ListAssets", @@ -409,11 +391 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console - "aidevops:UpdateAsset", - "aidevops:UpdateAssetFile" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsBacklogAccess", - "Effect": "Allow", - "Action": [ - "aidevops:CreateBacklogTask", - "aidevops:GetBacklogTask", + "aidevops:ListAssociations", @@ -421,21 +392,0 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console - "aidevops:ListGoals", - "aidevops:UpdateBacklogTask", - "aidevops:UpdateGoal" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsRecommendationAccess", - "Effect": "Allow", - "Action": [ - "aidevops:GetRecommendation", - "aidevops:ListRecommendations", - "aidevops:UpdateRecommendation" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsAgentChatAccess", - "Effect": "Allow", - "Action": [ - "aidevops:CreateChat", @@ -443,9 +393,0 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console - "aidevops:ListPendingMessages", - "aidevops:SendMessage" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsJournalAccess", - "Effect": "Allow", - "Action": [ @@ -453,35 +395,8 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console - "aidevops:ListJournalRecords" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsTopologyAccess", - "Effect": "Allow", - "Action": [ - "aidevops:DiscoverTopology" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsSupportAccess", - "Effect": "Allow", - "Action": [ - "aidevops:DescribeServices", - "aidevops:DescribeSupportLevel", - "aidevops:EndChatForCase", - "aidevops:InitiateChatForCase" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsUsageAccess", - "Effect": "Allow", - "Action": [ - "aidevops:GetAccountUsage" - ], - "Resource": "*" - }, - { - "Sid": "AIDevOpsTaggingAccess", - "Effect": "Allow", - "Action": [ + "aidevops:ListGoals", + "aidevops:ListJournalRecords", + "aidevops:ListKnowledgeItems", + "aidevops:ListKnowledgeItemVersions", + "aidevops:ListPendingMessages", + "aidevops:ListPrivateConnections", + "aidevops:ListRecommendations", + "aidevops:ListServices", @@ -488,0 +404,7 @@ Provides full access to Amazon DevOps Agent via the AWS Management Console + "aidevops:ListTriggers", + "aidevops:ListWebhooks",