AWS controltower: Fix broken documentation links and clarify security guidance
Summary
Corrected multiple broken hyperlinks by removing double slashes in URLs and maintained existing security recommendations.
Security assessment
The changes primarily fix broken URLs (removing '//' in links) without altering security content. The existing mention of confused deputy attacks remains unchanged and is not linked to a new vulnerability fix.
Evidence
+For more information about how to help protect against attackers when you grant permissions to other AWS service principals, see [Optional conditions for your role trust relationships](https://docs.aws.amazon.com/controltower/latest/userguide/conditions-for-role-trust.html). By adding certain conditions to your policies, you can help prevent a specific type of attack, known as a _confused deputy_ attack, which occurs if an entity coerces a more-privileged entity to perform an action, such as with cross-service impersonation. For general information about policy conditions, also see [Specifying conditions in a policy](./access-control-overview.html#specifying-conditions).
Diff
diff --git a/controltower/latest/userguide/assign-permissions.md b/controltower/latest/userguide/assign-permissions.md index 0b9c3db1c..335523713 100644 --- a//controltower/latest/userguide/assign-permissions.md +++ b//controltower/latest/userguide/assign-permissions.md @@ -17 +17 @@ To provide access, add permissions to your users, groups, or roles: -Create a permission set. Follow the instructions in [Create a permission set](https://docs.aws.amazon.com//singlesignon/latest/userguide/howtocreatepermissionset.html) in the _AWS IAM Identity Center User Guide_. +Create a permission set. Follow the instructions in [Create a permission set](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) in the _AWS IAM Identity Center User Guide_. @@ -21 +21 @@ Create a permission set. Follow the instructions in [Create a permission set](ht -Create a role for identity federation. Follow the instructions in [Create a role for a third-party identity provider (federation)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-idp.html) in the _IAM User Guide_. +Create a role for identity federation. Follow the instructions in [Create a role for a third-party identity provider (federation)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp.html) in the _IAM User Guide_. @@ -25 +25 @@ Create a role for identity federation. Follow the instructions in [Create a role - * Create a role that your user can assume. Follow the instructions in [Create a role for an IAM user](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-user.html) in the _IAM User Guide_. + * Create a role that your user can assume. Follow the instructions in [Create a role for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) in the _IAM User Guide_. @@ -27 +27 @@ Create a role for identity federation. Follow the instructions in [Create a role - * (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in [Adding permissions to a user (console)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) in the _IAM User Guide_. + * (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in [Adding permissions to a user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) in the _IAM User Guide_. @@ -213,2 +213,2 @@ IAM | (Recommended) Use console credentials as temporary credentials to sign pro - * For the AWS CLI, see [Login for AWS local development](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sign-in.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs, see [Login for AWS local development](https://docs.aws.amazon.com//sdkref/latest/guide/access-login.html) in the _AWS SDKs and Tools Reference Guide_. + * For the AWS CLI, see [Login for AWS local development](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs, see [Login for AWS local development](https://docs.aws.amazon.com/sdkref/latest/guide/access-login.html) in the _AWS SDKs and Tools Reference Guide_. @@ -219,2 +219,2 @@ Workforce identity (Users managed in IAM Identity Center) | Use temporary creden - * For the AWS CLI, see [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs, tools, and AWS APIs, see [IAM Identity Center authentication](https://docs.aws.amazon.com//sdkref/latest/guide/access-sso.html) in the _AWS SDKs and Tools Reference Guide_. + * For the AWS CLI, see [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs, tools, and AWS APIs, see [IAM Identity Center authentication](https://docs.aws.amazon.com/sdkref/latest/guide/access-sso.html) in the _AWS SDKs and Tools Reference Guide_. @@ -226,3 +226,3 @@ IAM | (Not recommended)Use long-term credentials to sign programmatic requests t - * For the AWS CLI, see [Authenticating using IAM user credentials](https://docs.aws.amazon.com//cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs and tools, see [Authenticate using long-term credentials](https://docs.aws.amazon.com//sdkref/latest/guide/access-iam-users.html) in the _AWS SDKs and Tools Reference Guide_. - * For AWS APIs, see [Managing access keys for IAM users](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. + * For the AWS CLI, see [Authenticating using IAM user credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs and tools, see [Authenticate using long-term credentials](https://docs.aws.amazon.com/sdkref/latest/guide/access-iam-users.html) in the _AWS SDKs and Tools Reference Guide_. + * For AWS APIs, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. @@ -234 +234 @@ IAM | (Not recommended)Use long-term credentials to sign programmatic requests t -For more information about how to help protect against attackers when you grant permissions to other AWS service principals, see [Optional conditions for your role trust relationships](https://docs.aws.amazon.com//controltower/latest/userguide/conditions-for-role-trust.html). By adding certain conditions to your policies, you can help prevent a specific type of attack, known as a _confused deputy_ attack, which occurs if an entity coerces a more-privileged entity to perform an action, such as with cross-service impersonation. For general information about policy conditions, also see [Specifying conditions in a policy](./access-control-overview.html#specifying-conditions). +For more information about how to help protect against attackers when you grant permissions to other AWS service principals, see [Optional conditions for your role trust relationships](https://docs.aws.amazon.com/controltower/latest/userguide/conditions-for-role-trust.html). By adding certain conditions to your policies, you can help prevent a specific type of attack, known as a _confused deputy_ attack, which occurs if an entity coerces a more-privileged entity to perform an action, such as with cross-service impersonation. For general information about policy conditions, also see [Specifying conditions in a policy](./access-control-overview.html#specifying-conditions).