AWS config: AWS Config: Important note on aggregator resource-level permissions
Summary
Adds an Important callout explaining that aggregator actions not in the listed set do not support resource-level permissions; allow statements must use '*' for Resource, and deny statements scoped to specific ARNs have no effect.
Security assessment
Clarifies IAM policy semantics for AWS Config aggregator actions, warning that ARN-scoped deny statements are ineffective for actions without resource-level permission support — directly relevant to writing correct least-privilege/deny policies.
Evidence
+Aggregator actions that are not in the following list do not support resource-level permissions. If an AWS Config aggregator action does not support resource-level permissions, you can still grant users permission to use it. However, a policy statement that allows the action must use `*` for the `Resource` element. Statements that deny access to specific resource ARNs do not affect the action.
Diff
diff --git a/config/latest/developerguide/security_iam_id-based-policy-examples.md b/config/latest/developerguide/security_iam_id-based-policy-examples.md index 1a63bc2..ab603b8 100644 --- a//config/latest/developerguide/security_iam_id-based-policy-examples.md +++ b//config/latest/developerguide/security_iam_id-based-policy-examples.md @@ -385,0 +386,4 @@ With resource-level permissions, you can allow read access and deny write access +###### Important + +Aggregator actions that are not in the following list do not support resource-level permissions. If an AWS Config aggregator action does not support resource-level permissions, you can still grant users permission to use it. However, a policy statement that allows the action must use `*` for the `Resource` element. Statements that deny access to specific resource ARNs do not affect the action. +