AWS app-mesh: Note on App Mesh service-linked role indirect permissions
Summary
Adds a note to the App Mesh service-linked role page warning that the role, not the caller's credentials, makes downstream calls, so principals gain indirect access that their deny policies do not restrict, with a cross-reference to the scoping guidance.
Security assessment
Documents the same indirect-permission/privilege-escalation behavior of the AWSServiceRoleForAppMesh role and points readers to the permission-scoping mitigations, making it security-relevant authorization guidance.
Evidence
+App Mesh uses this service-linked role, not the credentials of the calling principal, to call other AWS services on your behalf. Because of this, if you grant a principal permission to manage App Mesh resources, you also give that principal indirect access to any resource that the service-linked role can reach. IAM doesn't evaluate that principal's deny policies for those services when App Mesh makes the calls.
Diff
diff --git a/app-mesh/latest/userguide/using-service-linked-roles.md b/app-mesh/latest/userguide/using-service-linked-roles.md index 9e718e5..98e6305 100644 --- a//app-mesh/latest/userguide/using-service-linked-roles.md +++ b//app-mesh/latest/userguide/using-service-linked-roles.md @@ -70,0 +71,4 @@ JSON +App Mesh uses this service-linked role, not the credentials of the calling principal, to call other AWS services on your behalf. Because of this, if you grant a principal permission to manage App Mesh resources, you also give that principal indirect access to any resource that the service-linked role can reach. IAM doesn't evaluate that principal's deny policies for those services when App Mesh makes the calls. + +To control what a principal can reach through App Mesh, scope the principal's `appmesh` permissions. To learn how to scope these permissions, see [Scope App Mesh permissions to segment workloads](./security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-scope-permissions). +