AWS IAM: Clarify role manager default state and activation requirements
Summary
Added note about role manager being enabled by default in new AWS experience accounts and requirement to activate advanced features to disable it.
Security assessment
The change provides informational clarification about default settings and account setup processes without addressing vulnerabilities or security controls.
Evidence
For most AWS accounts, role manager is disabled by default. But if you created your account using our new AWS experience, role manager is enabled by default and cannot be disabled until you activate advanced features.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_create_role-manager.md b/IAM/latest/UserGuide/id_roles_create_role-manager.md index 72ffd20f8..590c84017 100644 --- a//IAM/latest/UserGuide/id_roles_create_role-manager.md +++ b//IAM/latest/UserGuide/id_roles_create_role-manager.md @@ -25 +25 @@ IAM roles created by role manager behave like any other role you create. You can -Enabling or disabling role manager requires the `iam:PutAccountProperties` permission. The AWS managed policy `IAMFullAccess` includes it. For all the permissions that role manager requires, see [Apply least-privilege permissions to a role created automatically](./id_roles_create_role-manager_least-privilege.html) +Enabling or disabling role manager requires the `iam:PutAccountProperties` permission. The AWS managed policy `IAMFullAccess` includes it. For all the permissions that role manager requires, see [Manage access to role manager](./id_roles_create_role-manager_enable-use.html). @@ -41,0 +42,4 @@ Roles created by role manager are not deleted when you disable role manager. +###### Note + +For most AWS accounts, role manager is disabled by default. But if you created your account using our new AWS experience, role manager is enabled by default and cannot be disabled until you activate advanced features. For more information, see [Activate advanced AWS features](https://docs.aws.amazon.com/accounts/latest/reference/activate-advanced-features.html). +