AWS rekognition: Tighten Rekognition adapter auto-update S3 policy and add SourceAccount condition

Service: rekognition · 2026-10-07 · Documentation high

File: rekognition/latest/dg/using-adapters-autoupdate.md · Type: iam

Summary

The example IAM policy that lets Rekognition access an S3 bucket during adapter auto-update now adds the policy Version element, removes the s3:HeadObject and s3:HeadBucket permissions (leaving only s3:PutObject), and adds a Condition requiring aws:SourceAccount to equal 111122223333.

Security assessment

Adding an aws:SourceAccount condition is a confused-deputy mitigation that scopes the service-role trust/access to a specific account, and dropping s3:HeadObject/s3:HeadBucket reduces granted S3 permissions — an authorization/least-privilege hardening of a documented policy (no CVE or specific incident referenced).

Evidence

+                        "aws:SourceAccount": "111122223333"

Diff

diff --git a/rekognition/latest/dg/using-adapters-autoupdate.md b/rekognition/latest/dg/using-adapters-autoupdate.md
index 77c76bb..312055c 100644
--- a//rekognition/latest/dg/using-adapters-autoupdate.md
+++ b//rekognition/latest/dg/using-adapters-autoupdate.md
@@ -39,0 +40 @@ The following policy allows Rekognition to access an Amazon S3 bucket during aut
+        "Version": "2012-10-17",
@@ -50,3 +51 @@ The following policy allows Rekognition to access an Amazon S3 bucket during aut
-                    "s3:PutObject",
-                    "s3:HeadObject",
-                    "s3:HeadBucket"
+                    "s3:PutObject"
@@ -57 +56,6 @@ The following policy allows Rekognition to access an Amazon S3 bucket during aut
-                ]
+                ],
+                "Condition": {
+                    "StringEquals": {
+                        "aws:SourceAccount": "111122223333"
+                    }
+                }