AWS controltower: Update cross-account IAM role docs for Config aggregator account
Summary
Clarified that BASELINE-ROLES stack creates programmatic cross-account IAM roles in each managed account including the Config aggregator account, and corrected the trust relationship artifact reference to AuditReadOnlyRole.
Security assessment
Documents cross-account IAM execution roles and their trust relationships, which is security-relevant access-control documentation; the change corrects role naming/scope but does not address a specific vulnerability.
Evidence
The AWS Control Tower stack `StackSet-AWSControlTowerBP-BASELINE-ROLES` creates these programmatic-only, cross-account IAM roles in each managed account, including the Config aggregator account (formerly the audit account). The Config aggregator account assumes these execution roles to access other accounts programmatically:
Diff
diff --git a/controltower/latest/userguide/roles-how.md b/controltower/latest/userguide/roles-how.md index 54de4223d..9cb83b682 100644 --- a//controltower/latest/userguide/roles-how.md +++ b//controltower/latest/userguide/roles-how.md @@ -127 +127 @@ The audit account gives you programmatic access to other accounts, by means of s -The AWS Control Tower stack `StackSet-AWSControlTowerBP-BASELINE-ROLES` creates these programmatic-only, cross-account IAM roles in the audit account: +The AWS Control Tower stack `StackSet-AWSControlTowerBP-BASELINE-ROLES` creates these programmatic-only, cross-account IAM roles in each managed account, including the Config aggregator account (formerly the audit account). The Config aggregator account assumes these execution roles to access other accounts programmatically: @@ -291 +291 @@ JSON -The following artifact shows the trust relationship for `aws-controltower-AuditAdministratorRole`: +The following artifact shows the trust relationship for `aws-controltower-AuditReadOnlyRole`: