AWS vpc: Document AWSServiceRoleForIPAMOutbound service-linked role
Summary
Adds a new section describing the AWSServiceRoleForIPAMOutbound service-linked role used for external-provider discovery, including its trust policy allowing outbound.ipam.amazonaws.com to assume the role, the token-audience restriction, and create/edit/delete procedures.
Security assessment
Documents a new service-linked role, its trust policy principal, and the token-audience restriction that denies requests without an audience. This is IAM/authorization documentation with security impact but no specific vulnerability addressed.
Evidence
Also attached to the service-linked role is an [IAM trust policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html#id_roles_terms-and-concepts) that permits the `outbound.ipam.amazonaws.com` service to assume the service-linked role.
Diff
diff --git a/vpc/latest/ipam/iam-ipam-slr.md b/vpc/latest/ipam/iam-ipam-slr.md index 6e2b028..4dad804 100644 --- a//vpc/latest/ipam/iam-ipam-slr.md +++ b//vpc/latest/ipam/iam-ipam-slr.md @@ -7 +7 @@ -Service-linked role permissionsCreate the service-linked roleEdit the service-linked roleDelete the service-linked role +Service-linked role permissions for IPAMCreate the service-linked role for IPAMEdit the service-linked role for IPAMDelete the service-linked role for IPAMService-linked role permissions for external providersCreate the service-linked role for external providersEdit the service-linked role for external providersDelete the service-linked role for external providers @@ -15 +15,10 @@ A service-linked role makes setting up IPAM easier because you don't have to man -## Service-linked role permissions +IPAM uses the following service-linked roles: + + * **AWSServiceRoleForIPAM** – IPAM uses this role to discover and monitor resources and their IP addresses in your AWS accounts. For more information, see Service-linked role permissions for IPAM. + + * **AWSServiceRoleForIPAMOutbound** – IPAM uses this role to discover resources and their IP addresses in external providers during external-source discovery. For more information, see Service-linked role permissions for external providers. + + + + +## Service-linked role permissions for IPAM @@ -21 +30 @@ Also attached to the service-linked role is an [IAM trust policy](https://docs.a -## Create the service-linked role +## Create the service-linked role for IPAM @@ -58 +67 @@ If you use IPAM with a single AWS account, before you create an IPAM, you must e -## Edit the service-linked role +## Edit the service-linked role for IPAM @@ -62 +71 @@ You can't edit the **AWSServiceRoleForIPAM** service-linked role. -## Delete the service-linked role +## Delete the service-linked role for IPAM @@ -82,0 +92,31 @@ Follow these steps to delete the service-linked role using the AWS CLI: +## Service-linked role permissions for external providers + +IPAM uses the **AWSServiceRoleForIPAMOutbound** service-linked role to call the actions in the attached **AWSIPAMOutboundServiceRolePolicy** managed policy. With this policy, IPAM requests an AWS web identity token (`sts:GetWebIdentityToken`). IPAM uses this token to federate into external providers of IPAM resources. The policy restricts the token audience to the external providers that IPAM supports. A request without an audience is denied. For more information about the managed policy, see [AWS managed policies for IPAM](./iam-ipam-managed-pol.html). + +Also attached to the service-linked role is an [IAM trust policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html#id_roles_terms-and-concepts) that permits the `outbound.ipam.amazonaws.com` service to assume the service-linked role. + +## Create the service-linked role for external providers + +You don't need to manually create the **AWSServiceRoleForIPAMOutbound** service-linked role. IPAM creates the role in your account when you create a resource discovery with an external source. The account that creates the resource discovery must have an IAM policy attached to it that permits the `iam:CreateServiceLinkedRole` action. + +## Edit the service-linked role for external providers + +You can't edit the **AWSServiceRoleForIPAMOutbound** service-linked role. + +## Delete the service-linked role for external providers + +If you no longer need to discover resources in external providers, delete the **AWSServiceRoleForIPAMOutbound** service-linked role. + +###### Note + +You can delete the service-linked role only after you delete every resource discovery in your AWS account that uses an external source. This ensures that you can't inadvertently stop the discovery of your resources in external providers. + +Follow these steps to delete the service-linked role using the AWS CLI: + + 1. Delete each resource discovery that uses an external source with the `delete-ipam-resource-discovery` command. For more information, see [delete IPAM resource discovery](https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-ipam-resource-discovery.html) in the _AWS CLI Command Reference_. + + 2. Delete the service-linked role with the `delete-service-linked-role` command. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html#id_roles_manage_delete_slr) in the _IAM User Guide_. + + + +