AWS mgn: Clarified instance profile usage restriction to same-account replication
Summary
Added clarification that instance profiles for EC2 agents can only be used for same-account replication
Security assessment
Prevents potential cross-account privilege escalation by restricting instance profile usage to same-account scenarios
Evidence
+This option can only be used when replicating a server within the same account.
Diff
diff --git a/mgn/latest/ug/credentials.md b/mgn/latest/ug/credentials.md index 939ee6f5c..3413ac1c4 100644 --- a//mgn/latest/ug/credentials.md +++ b//mgn/latest/ug/credentials.md @@ -42 +42 @@ Where possible, we recommend using temporary credentials instead of creating use -When installing an AWS Replication Agent on an Amazon EC2 instance (when the source server is in AWS Regions), you don't need to generate credentials. Instead, you can use an instance profile with the required IAM policy: +When installing an AWS Replication Agent on an Amazon EC2 instance (when the source server is in AWS Regions), you don't need to generate credentials. Instead, you can use an instance profile with the required IAM policy. This option can only be used when replicating a server within the same account.