AWS workspaces: WorkSpaces access control: GovCloud ARN notes and CLI typo fix
Summary
Adds notes clarifying that IAM service-linked role and WorkSpaces resource ARNs use the aws partition in standard Regions but aws-us-gov in AWS GovCloud (US), updates a streaming-instances link label to WorkSpaces Pool instances, and fixes a malformed 'aws iam attach-role-policy' command (em-dash corrected to double-dash).
Security assessment
The changed lines are IAM-policy ARN partition guidance and a terminology/link-label and CLI typo fix. They affect correctness of IAM policy examples (including a broken attach-role-policy command) but do not describe or fix a vulnerability, credential handling, or public-exposure issue, so security relevance is tangential.
Evidence
+This example uses the `aws` partition in the `iam:CreateServiceLinkedRole` resource ARN. In the AWS GovCloud (US) Regions, use the `aws-us-gov` partition instead (for example, `arn:aws-us-gov:iam::*:role/aws-service-role/...`). For more information, see [Amazon Resource Names (ARNs) in AWS GovCloud (US) Regions](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html).
Diff
diff --git a/workspaces/latest/adminguide/workspaces-access-control.md b/workspaces/latest/adminguide/workspaces-access-control.md index b4f61387c..7aa5f3db0 100644 --- a//workspaces/latest/adminguide/workspaces-access-control.md +++ b//workspaces/latest/adminguide/workspaces-access-control.md @@ -61 +61 @@ Following are additional resources for IAM: - * [Access to WorkSpaces and scripts on streaming instances](./using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances.html) + * [Access to WorkSpaces and scripts on WorkSpaces Pool instances](./using-iam-roles-to-grant-permissions-to-applications-scripts-streaming-instances.html) @@ -254,0 +255,4 @@ The following policy statement grants an IAM user permission to perform all Work +###### Note + +This example uses the `aws` partition in the `iam:CreateServiceLinkedRole` resource ARN. In the AWS GovCloud (US) Regions, use the `aws-us-gov` partition instead (for example, `arn:aws-us-gov:iam::*:role/aws-service-role/...`). For more information, see [Amazon Resource Names (ARNs) in AWS GovCloud (US) Regions](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html). + @@ -394,0 +399,4 @@ To specify an WorkSpaces resource in the `Resource` element of the policy statem +###### Note + +The ARN examples in this section use the `aws` partition, which applies to standard AWS Regions. If you're working in the AWS GovCloud (US) Regions, use the `aws-us-gov` partition instead (for example, `arn:aws-us-gov:workspaces:us-gov-west-1:`account_id`:workspace/`workspace_identifier``), and specify `us-gov-west-1` or `us-gov-east-1` for the Region. For more information, see [Amazon Resource Names (ARNs) in AWS GovCloud (US) Regions](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html) in the _AWS GovCloud (US) User Guide_. + @@ -762 +770,5 @@ JSON - aws iam attach-role-policy —role-name AmazonWorkSpacesPCAAccess —policy-arn arn:aws:iam::aws:policy/AmazonWorkspacesPCAAccess + aws iam attach-role-policy --role-name AmazonWorkSpacesPCAAccess --policy-arn arn:aws:iam::aws:policy/AmazonWorkspacesPCAAccess + +###### Note + +In the AWS GovCloud (US) Regions, use the `aws-us-gov` partition in the managed policy ARN: `arn:aws-us-gov:iam::aws:policy/AmazonWorkspacesPCAAccess`. For more information, see [Amazon Resource Names (ARNs) in AWS GovCloud (US) Regions](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html).