AWS resilience-hub: Replace ReadOnlyAccess with assessment execution policy

Service: resilience-hub · 2026-09-27 · Documentation medium

File: resilience-hub/latest/userguide/next-gen-multi-account-setup.md · Type: iam

Summary

Changes the recommended IAM policy for the cross-account role from ReadOnlyAccess to the purpose-built AWSResilienceHubV2AssessmentExecutionPolicy.

Security assessment

Swaps a broad AWS managed policy (ReadOnlyAccess) for a service-specific execution policy, which is a least-privilege hardening improvement in IAM setup guidance, though no specific vulnerability is cited.

Evidence

+  * `AWSResilienceHubV2AssessmentExecutionPolicy` attached.

Diff

diff --git a/resilience-hub/latest/userguide/next-gen-multi-account-setup.md b/resilience-hub/latest/userguide/next-gen-multi-account-setup.md
index 1912faf0a..27c19a920 100644
--- a//resilience-hub/latest/userguide/next-gen-multi-account-setup.md
+++ b//resilience-hub/latest/userguide/next-gen-multi-account-setup.md
@@ -15 +15 @@ In each account that contains resources for your service, create a role with:
-  * `ReadOnlyAccess` policy attached.
+  * `AWSResilienceHubV2AssessmentExecutionPolicy` attached.