AWS appstream2: Clarify confused deputy prevention S3 bucket policy example
Summary
Rewords the confused deputy prevention note, replaces placeholder account ID with 111122223333, and cleans up example bucket policy formatting.
Security assessment
The example demonstrates confused deputy prevention using aws:SourceAccount conditions in an S3 bucket policy, which is a security best-practice (IAM condition keys to prevent cross-service impersonation). It documents an existing control rather than fixing a specific vulnerability.
Evidence
+ "aws:SourceAccount": "111122223333"
Diff
diff --git a/appstream2/latest/developerguide/example-s3-bucket.md b/appstream2/latest/developerguide/example-s3-bucket.md index cf420f9..b90abbf 100644 --- a//appstream2/latest/developerguide/example-s3-bucket.md +++ b//appstream2/latest/developerguide/example-s3-bucket.md @@ -22,8 +22 @@ The resource policies below show how to prevent the confused deputy problem with -WorkSpaces Applications currently doesn't support confused deputy prevention for application icons. The service only supports VHD files and setup scripts. If you try to add additional conditions for application icons, the icons won't be displayed to end users. - -In the following example, the bucket policy only allows WorkSpaces Applications Elastic fleet resources in the owner's account to access `ELASTIC_FLEET_EXAMPLE_BUCKET`. - -JSON - - -**** +WorkSpaces Applications currently doesn't support confused deputy prevention for application icons. WorkSpaces Applications only supports VHD files and setup scripts. If you try to add additional conditions for application icons, the icons won't be displayed to end users. @@ -30,0 +24 @@ JSON +In the following example, the bucket policy only allows WorkSpaces Applications Elastic fleet resources in the owner's account to access `ELASTIC-FLEET-EXAMPLE-BUCKET`. @@ -49 +43 @@ JSON - "aws:SourceAccount": "your AWS account ID" + "aws:SourceAccount": "111122223333" @@ -118,6 +110,0 @@ If you don’t know the full ARN of a resources, or if you want to specify multi -JSON - - -**** - - @@ -144 +131 @@ JSON - "aws:SourceAccount": "your AWS account ID" + "aws:SourceAccount": "111122223333"