AWS config: AWS Config: document aggregator resource-level permission limitation
Summary
Adds a document-history entry clarifying that AWS Config aggregator API actions not listed in the topic do not support resource-level permissions, so deny statements targeting specific aggregator ARNs do not affect them.
Security assessment
Documents an authorization gotcha where IAM deny statements scoped to specific aggregator ARNs are ineffective for actions lacking resource-level permission support, which is important for correctly restricting access.
Evidence
+Clarified resource-level permissions for aggregator actions| AWS Config aggregator API actions that are not listed in this topic do not support resource-level permissions. Policy statements that deny specific aggregator ARNs do not affect these actions. For more information, see [Supported Resource-Level Permissions for Multi-Account Multi-Region Data Aggregation](https://docs.aws.amazon.com/config/latest/developerguide/security_iam_id-based-policy-examples.html#resource-level-permission).| November 3, 2026
Diff
diff --git a/config/latest/developerguide/DocumentHistory.md b/config/latest/developerguide/DocumentHistory.md index af25e87..d71c093 100644 --- a//config/latest/developerguide/DocumentHistory.md +++ b//config/latest/developerguide/DocumentHistory.md @@ -21,0 +22 @@ Change| Description| Date +Clarified resource-level permissions for aggregator actions| AWS Config aggregator API actions that are not listed in this topic do not support resource-level permissions. Policy statements that deny specific aggregator ARNs do not affect these actions. For more information, see [Supported Resource-Level Permissions for Multi-Account Multi-Region Data Aggregation](https://docs.aws.amazon.com/config/latest/developerguide/security_iam_id-based-policy-examples.html#resource-level-permission).| November 3, 2026