AWS resilience-hub: Resilience Hub: sharing policies across an organization
Summary
Adds guidance on sharing a policy directly with an organization (visible in every member account, applied at service owners' discretion) versus associating it with a system so it applies to every associated service regardless of owning account; also renames a TOC entry to 'Tracking changes to a shared policy'.
Security assessment
Describes governance of resilience policies across an AWS Organization, i.e., scope of application to member accounts and services. It is an operational/administrative scoping change, not a vulnerability fix or a security control documented.
Evidence
+You can also share a policy directly with your organization instead of applying it through a system. A shared policy is visible in every member account, and service owners choose whether to apply it to their services.
Diff
diff --git a/resilience-hub/latest/userguide/next-gen-org-policies.md b/resilience-hub/latest/userguide/next-gen-org-policies.md index 2a5068d32..f997e5f9b 100644 --- a//resilience-hub/latest/userguide/next-gen-org-policies.md +++ b//resilience-hub/latest/userguide/next-gen-org-policies.md @@ -21,0 +22,2 @@ The system-level policy applies to all services associated with that system, reg +You can also share a policy directly with your organization instead of applying it through a system. A shared policy is visible in every member account, and service owners choose whether to apply it to their services. Share a policy directly when service teams own the decision to adopt it. Associate the policy with a system when you want it applied to every associated service, regardless of which account owns the service. For more information, see [Sharing a policy across your organization](./next-gen-policy-sharing.html). + @@ -30 +32 @@ Service-Linked Roles -Viewing organization-wide resilience posture +Tracking changes to a shared policy