IAM security notification - aws-portal and purchase-orders

0

Yesterday, we received a notification email from AWS that one or more of our policies were still using actions that are going to be deprecated.

Namely, one or more of the aws-portal or purchase-order actions that are being deprecated in lieu of finer-grained actions. When I went to the AWS Health Dashboard to find the affected resource, I was able to find the affected policy, and was able determine that while the current (default) version of the policy did not contain the soon-to-be deprecated actions, older version of the policy that were retained did.

I have since deleted the older versions of the affected policy that contained those actions (while retaining one older version of the policy that does not have those actions). However, in the AWS health dashboard, it still says lists the IAM security notification.

My question then is, will that security notification go away on it's own at some point (it has not gone away yet, even with reloading the dashboard), or does it indicate that despite deleting the older versions of the affected policy that there is still something that needs to be done?

I am at a loss here, as neither version of the policy in question seems to have those actions.

Here's the JSON of the policy

{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ce:Get*", "ce:Describe*", "ce:List*", "account:GetAccountInformation", "billing:", "payments:", "payments:", "tax:", "tax:", "consolidatedbilling:", "consolidatedbilling:", "invoicing:", "invoicing:", "cur:", "cur:", "freetier:Get", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "payments:ListPaymentPreferences", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "account:CloseAccount", "account:DeleteAlternateContact", "account:PutAlternateContact", "account:PutChallengeQuestions", "account:PutContactInformation", "billing:PutContractInformation", "billing:UpdateIAMAccessPreference", "billing:RedeemCredits", "billing:UpdateBillingPreferences", "payments:UpdatePaymentPreferences", "ce:CreateAnomalyMonitor", "ce:CreateAnomalySubscription", "ce:CreateNotificationSubscription", "ce:createReport", "ce:DeleteAnomalyMonitor", "ce:DeleteAnomalySubscription", "ce:DeleteNotificationSubscription", "ce:DeleteReport", "ce:ProvideAnomalyFeedback", "ce:StartSavingsPlansPurchaseRecommendationGeneration", "ce:UpdateAnomalyMonitor", "ce:UpdateAnomalySubscription", "ce:UpdateCostAllocationTagsStatus", "ce:UpdateNotificationSubscription", "ce:UpdatePreferences", "cur:PutClassicReportPreferences", "freetier:PutFreeTierAlertPreference", "invoicing:PutInvoiceEmailDeliveryPreferences", "payments:CreatePaymentInstrument", "payments:DeletePaymentInstrument", "payments:MakePayment", "payments:UpdatePaymentPreferences", "tax:BatchPutTaxRegistration", "tax:DeleteTaxRegistration", "tax:PutTaxInheritance", "account:GetAccountInformation", "payments:DeletePaymentInstrument", "payments:CreatePaymentInstrument", "payments:MakePayment", "payments:UpdatePaymentPreferences", "invoicing:GetInvoicePDF", "payments:ListPaymentPreferences", "purchase-orders:GetPurchaseOrder", "purchase-orders:ListPurchaseOrderInvoices", "purchase-orders:ListPurchaseOrders", "purchase-orders:AddPurchaseOrder", "purchase-orders:DeletePurchaseOrder", "purchase-orders:UpdatePurchaseOrder", "purchase-orders:UpdatePurchaseOrderStatus" ], "Resource": "*" } ] }

2개 답변
0

You check the 'Affected Policies' section of your Billing Dashboard by following this link:  

[+] https://us-east-1.console.aws.amazon.com/poliden/home?region=us-east-1#/

If there are no policies listed under the 'Affected Policies' section, then this could be a false alarm, and you can ignore the notification as of now as there are no policy updates required. AWS Health Dashboard sends notifications all the time just to keep reminding you if the event was ever relevant to you since this is a big change. These notifications are sent by the service teams in order to ensure that you are updated and aware of the active events.

Hence, if you have already verified there is no policy to update from the affected policy tab, it is safe to take the notification for information purpose.

profile picture
답변함 5달 전
  • That's the thing.... I am able to find the policy that it claims is affected, but the actions that are being deprecated do not appear in the JSON of the policy.

  • Are you able to share the complete policy which is marked as affected? Please remove any confidential data, account id, resource details etc from the policy before sharing.

  • I added the JSON of the policy in the original question.

  • The above shared policy is not using any retired actions. There is no point this policy should be marked as affected in the "Affected Policies" tool. Please report it to AWS. Thanks

0

Hello.

Looking at this document, it seems that updates are made every day, so I expect it will take some time for it to disappear.
https://docs.aws.amazon.com/health/latest/ug/getting-started-health-dashboard.html

For planned lifecycle events, AWS Health events typically provide daily updates of affected resources' status. To view the status, select the AWS Health event. The status displays in the affected resources tab in the side panel.

profile picture
전문가
답변함 5달 전
  • It's been almost two days, and the AWS Health Dashboard notification is still there. I've also looked at every Customer Managed policy we have listed, and the actions that are being deprecated appear in none of them.

    I have also noticed that the AWS Health Dashboard is still listing the "upgrade your version of MySQL for your RDS" notification even though that was done weeks ago. So it's possible that the AWS Health Dashboard isn't properly removing notifications.

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠