AWS config: AWS CLI config guide: add IAM trust policy examples, fix ARN typos
Summary
Adds the Test-Role-Trust-Policy.json contents (Principal arn:aws:iam::123456789012:root, Effect Allow, Action sts:AssumeRole) to the create-role examples, changes the S3 create-bucket region example from eu-west-1 to us-west-2, removes a ResponseMetadata block, fixes malformed account IDs (12345678012 -> 123456789012) and a broken IAM doc link, and standardizes 'command' to 'example'.
Security assessment
The newly added JSON is an illustrative IAM role trust policy showing the sts:AssumeRole action and account principal used by the create-role example; it clarifies IAM configuration but does not fix a vulnerability or state a security best practice, while the rest of the diff is region/ARN/link housekeeping.
Evidence
+ "AWS": "arn:aws:iam::123456789012:root"
Diff
diff --git a/config/latest/developerguide/gs-cli-prereq.md b/config/latest/developerguide/gs-cli-prereq.md index fac253c..02b9458 100644 --- a//config/latest/developerguide/gs-cli-prereq.md +++ b//config/latest/developerguide/gs-cli-prereq.md @@ -361 +361 @@ CLI -The following `create-bucket` example creates a bucket named `amzn-s3-demo-bucket`: +The following `create-bucket` example creates a bucket named `amzn-s3-demo-bucket`. @@ -400 +400 @@ For more information, see [Controlling ownership of objects and disabling ACLs]( -The following `create-bucket` example creates a bucket named `amzn-s3-demo-bucket` in the `eu-west-1` region. Regions outside of `us-east-1` require the appropriate `LocationConstraint` to be specified in order to create the bucket in the desired region. +The following `create-bucket` example creates a bucket named `amzn-s3-demo-bucket` in the `us-west-2` region. Regions outside of `us-east-1` require the appropriate `LocationConstraint` to be specified in order to create the bucket in the desired region. @@ -405,2 +405,2 @@ The following `create-bucket` example creates a bucket named `amzn-s3-demo-bucke - --region eu-west-1 \ - --create-bucket-configuration LocationConstraint=eu-west-1 + --region us-west-2 \ + --create-bucket-configuration LocationConstraint=us-west-2 @@ -1421,3 +1420,0 @@ Output: - "ResponseMetadata": { - "RequestId": "1469e8d7-1642-564e-b85d-a19b4b341f83" - }, @@ -2202 +2199 @@ CLI -The following `create-role` command creates a role named `Test-Role` and attaches a trust policy to it. +The following `create-role` example creates a role named `Test-Role` and attaches a trust policy to it. @@ -2209,0 +2207,17 @@ The following `create-role` command creates a role named `Test-Role` and attache +Contents of `Test-Role-Trust-Policy.json`: + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "Statement1", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::123456789012:root" + }, + "Action": "sts:AssumeRole" + } + ] + } + @@ -2232 +2246 @@ For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/l -The following `create-role` command creates a role named `Test-Role` and sets a maximum session duration of 7200 seconds (2 hours). +The following `create-role` example creates a role named `Test-Role` and sets a maximum session duration of 7200 seconds (2 hours). @@ -2240,0 +2255,17 @@ The following `create-role` command creates a role named `Test-Role` and sets a +Contents of `Test-Role-Trust-Policy.json`: + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "Statement1", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::123456789012:root" + }, + "Action": "sts:AssumeRole" + } + ] + } + @@ -2249 +2280 @@ Output: - "Arn": "arn:aws:iam::12345678012:role/Test-Role", + "Arn": "arn:aws:iam::123456789012:role/Test-Role", @@ -2258 +2289 @@ Output: - "AWS": "arn:aws:iam::12345678012:root" + "AWS": "arn:aws:iam::123456789012:root" @@ -2267 +2298 @@ Output: -For more information, see [Modifying a role maximum session duration (AWS API)](https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-api.html#roles-modify_max-session-duration-api) in the _AWS IAM User Guide_. +For more information, see [Modifying a role maximum session duration (AWS API)](https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-api.html) in the _AWS IAM User Guide_. @@ -2271 +2302 @@ For more information, see [Modifying a role maximum session duration (AWS API)]( -The following command creates an IAM Role `Test-Role` with tags. This example uses the `--tags` parameter flag with the following JSON-formatted tags: `'{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'`. Alternatively, the `--tags` flag can be used with tags in the shorthand format: `'Key=Department,Value=Accounting Key=Location,Value=Seattle'`. +The following `create-role` example creates an IAM role `Test-Role` with tags. This example uses the `--tags` parameter flag with the following JSON-formatted tags: `'{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'`. Alternatively, the `--tags` flag can be used with tags in the shorthand format: `'Key=Department,Value=Accounting Key=Location,Value=Seattle'`. @@ -2279,0 +2311,17 @@ The following command creates an IAM Role `Test-Role` with tags. This example us +Contents of `Test-Role-Trust-Policy.json`: + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "Statement1", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::123456789012:root" + }, + "Action": "sts:AssumeRole" + } + ] + } +