AWS notifications: Document resource ARNs for sensitive-event IAM actions

Service: notifications · 2026-09-27 · Documentation medium

File: notifications/latest/userguide/resource-level-permissions.md · Type: iam

Summary

Adds resource-level permission rows for UpdateManagedNotificationChannelAssociation, SubscribeSensitiveEvents, and AccessSensitiveEvents, each scoped to a managed-notification-configuration category/sub-category ARN (example: AWS-BCM/Billing-and-Invoices).

Security assessment

Documents IAM actions (including sensitive-event subscribe/access) and the resource ARNs that support fine-grained, least-privilege policies; this is permission-scoping documentation with a security impact but no indication it fixes a specific vulnerability.

Evidence

+SubscribeSensitiveEvents |  `arn:aws:notifications::`accountId`:managed-notification-configuration/category/`category-name`/sub-category/`sub-category-name`` |  `arn:aws:notifications::123456789012:managed-notification-configuration/category/AWS-BCM/sub-category/Billing-and-Invoices`  

Diff

diff --git a/notifications/latest/userguide/resource-level-permissions.md b/notifications/latest/userguide/resource-level-permissions.md
index 03b270d42..e0eb3e8cf 100644
--- a//notifications/latest/userguide/resource-level-permissions.md
+++ b//notifications/latest/userguide/resource-level-permissions.md
@@ -31,0 +32,3 @@ ListManagedNotificationChannelAssociations |  `arn:aws:notifications::`accountId
+UpdateManagedNotificationChannelAssociation |  `arn:aws:notifications::`accountId`:managed-notification-configuration/category/`category-name`/sub-category/`sub-category-name`` |  `arn:aws:notifications::123456789012:managed-notification-configuration/category/AWS-BCM/sub-category/Billing-and-Invoices`  
+SubscribeSensitiveEvents |  `arn:aws:notifications::`accountId`:managed-notification-configuration/category/`category-name`/sub-category/`sub-category-name`` |  `arn:aws:notifications::123456789012:managed-notification-configuration/category/AWS-BCM/sub-category/Billing-and-Invoices`  
+AccessSensitiveEvents |  `arn:aws:notifications::`accountId`:managed-notification-configuration/category/`category-name`/sub-category/`sub-category-name`` |  `arn:aws:notifications::123456789012:managed-notification-configuration/category/AWS-BCM/sub-category/Billing-and-Invoices`