📣 Sponsor

IAM is hard 😭😡
We feel your pain – so we wrote a song about it!
We hope you enjoy k9 Security’s new original IAM song: 🎵 Keys to the Cloud 🎵

🥗 Appetizer

Hey folks,

This is the first episode of the season. I hope you enjoyed your summer with family and friends.

Here's the digest of what you've missed in the past few weeks in the AWS Security world.

I have spent too much time scrolling the news, so you don't have to...

👀 Monitor AWS Managed IAM Policies

Managed Policy changed since last week: 5

1. AWSSupportServiceRolePolicy
2. AmazonLaunchWizardFullAccessV2
3. AmazonSageMakerCanvasFullAccess
4. ComputeOptimizerReadOnlyAccess
5. SecretsManagerReadWrite

Weekly diff

🤖 Powered by MAMIP

🍔 AWS API Changes

Amazon EC2 Container Service - 4 updated methods This release adds support for an account-level setting that you can use to configure the number of days for AWS Fargate task retirement.

Service Quotas - 8 updated methods Service Quotas now supports viewing the applied quota value and requesting a quota increase for a specific resource in an AWS account.

Amazon SageMaker Service - 6 updated methods Amazon SageMaker Canvas adds IdentityProviderOAuthSettings support for CanvasAppSettings

🍓 IAM Permission Changes

bedrock: 1 updated action | 4 removed actions 1 updated action: ListTagsForResource (access); 4 removed actions: DeletePrompt (Grants permission to delete a saved prompt), GetPrompt (Grants permission to get a saved prompt), ListPrompts (Grants permission to lists all prompts saved to a playground), UpdatePrompt (Grants permission to updates a saved prompt)

acm: 1 updated condition 1 updated condition: acm:DomainNames (type)

pca-connector-ad: 25 new actions, 5 new resources, 3 new conditions 25 new actions: CreateConnector (Grants permission to create a Connector in your account), CreateDirectoryRegistration (Grants permission to create a DirectoryRegistration in your account), CreateServicePrincipalName (Grants permission to create a ServicePrincipalName for a DirectoryRegistration), CreateTemplate (Grants permission to create a Template for a Connector), CreateTemplateGroupAccessControlEntry (Grants permission to create a TemplateGroupAccessControlEntry for a Template), DeleteConnector (Grants permission to delete a Connector in your account), DeleteDirectoryRegistration...