AWS workspaces-web: Add SourceAccount/SourceArn conditions to session logger S3 policy

Service: workspaces-web · 2026-09-30 · Documentation medium

File: workspaces-web/latest/adminguide/session-logger.md · Type: iam

Summary

Adds aws:SourceAccount and aws:SourceArn condition keys to the example S3 bucket policy for the session logger, plus the availability notice.

Security assessment

The example bucket policy now scopes access with aws:SourceAccount and aws:SourceArn (ArnLike on arn:aws:workspaces-web:region:account-id:sessionLogger/*), the standard confused-deputy prevention pattern that prevents other accounts/services from writing to the logging bucket. This is security hardening documentation rather than a fix for a specific disclosed vulnerability.

Evidence

+                        "aws:SourceAccount": "account-id"

Diff

diff --git a/workspaces-web/latest/adminguide/session-logger.md b/workspaces-web/latest/adminguide/session-logger.md
index 8de7cff..4528388 100644
--- a//workspaces-web/latest/adminguide/session-logger.md
+++ b//workspaces-web/latest/adminguide/session-logger.md
@@ -8,0 +9,2 @@ S3 buckets with KMS encryption
+Amazon WorkSpaces Secure Browser will no longer be open to new customers starting October 29, 2026. If you would like to use Amazon WorkSpaces Secure Browser, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon WorkSpaces Secure Browser availability change](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/workspaces-secure-browser-maintenance-mode.html). 
+
@@ -47 +49,9 @@ Below is an example of a policy for your Amazon S3 bucket. Make sure to update t
-                ]
+                ],
+                "Condition": {
+                    "StringEquals": {
+                        "aws:SourceAccount": "account-id"
+                    },
+                    "ArnLike": {
+                        "aws:SourceArn": "arn:aws:workspaces-web:region:account-id:sessionLogger/*"
+                    }
+                }