AWS controltower: Correct IAM role name recreated during decommissioning
Summary
Fixes the recreated IAM role name from OrganizationsFullAccessRole to OrganizationAccountAccessRole in the decommissioning process description.
Security assessment
The change corrects an IAM role name referenced in the decommissioning workflow, which affects permission/role documentation accuracy but does not describe a fixed vulnerability or new security control.
Evidence
+ * Revokes the AWS Control Tower permissions to the account by removing the IAM role that AWS Control Tower created (unless additional policies have been added to it) and recreates the standard `OrganizationAccountAccessRole` IAM role.
Diff
diff --git a/controltower/latest/userguide/decommissioning-process-overview.md b/controltower/latest/userguide/decommissioning-process-overview.md index 8ee51375f..72d6fd54a 100644 --- a//controltower/latest/userguide/decommissioning-process-overview.md +++ b//controltower/latest/userguide/decommissioning-process-overview.md @@ -23 +23 @@ When you request decommissioning of your landing zone, AWS Control Tower does th - * Revokes the AWS Control Tower permissions to the account by removing the IAM role that AWS Control Tower created (unless additional policies have been added to it) and recreates the standard `OrganizationsFullAccessRole` IAM role. + * Revokes the AWS Control Tower permissions to the account by removing the IAM role that AWS Control Tower created (unless additional policies have been added to it) and recreates the standard `OrganizationAccountAccessRole` IAM role. @@ -31 +31 @@ When you request decommissioning of your landing zone, AWS Control Tower does th - * Revokes the AWS Control Tower permissions from the shared accounts by removing the IAM role that AWS Control Tower created (unless additional policies have been added to it) and recreates the `OrganizationsFullAccessRole` IAM role. + * Revokes the AWS Control Tower permissions from the shared accounts by removing the IAM role that AWS Control Tower created (unless additional policies have been added to it) and recreates the `OrganizationAccountAccessRole` IAM role.