AWS docs accuracy pass: apply ARTE course corrections + fix stale facts

[carlospolop]

What

An accuracy/staleness pass over the ARTE-relevant aws-security pages, driven by the corrections/improvements already written for the ARTE (AWS Red Team Expert) course and cross-checked against current AWS documentation (verified Sept 2026). Surgical accuracy edits only — no stylistic rewrites, no reformatting; correct content and page structure left untouched.

23 files changed, +129 / −21. ~130 ARTE-relevant pages were reviewed; the majority were already up to date and left unchanged.

Highlights

Foundations & IAM/STS

• Organizations: unique-email → root-username rule; RCP now 40+ services (was ~5 at Nov-2024 launch) + RCP exceptions (management account, service-linked roles, AWS-managed KMS keys); IAM Centralized Root Access (new member accounts have no root creds by default; sts:AssumeRoot privileged sessions); password custom-policy details.
• Fixed a malformed OIDC account id (0123456789 → 123456789012).
• IAM privesc: added the missing iam:PassRole (+ compute) escalation primitive.
• IAM post-exp: fixed an invalid confused-deputy principal.
• STS: AKIA/ASIA prefix meaning + GetSessionToken limits; external-id / confused-deputy trust note.

Services

• Secrets Manager: same-account kms:Decrypt for CMK secrets; ForceDeleteWithoutRecovery.
• Lambda post-exp: 2026 metadata endpoint (AZ-only, token-gated) clarification.
• EC2 enum: IMDSv1/IMDSv2 default nuance (2024 per-Region defaults, imds-support).
• RDS enum: Aurora modify-db-cluster master-password variant.
• DynamoDB enum: PITR RecoveryPeriodInDays (1–35d, configurable).
• EFS enum: four console policy building blocks + encryption subsection.
• API Gateway enum: API-type vs REST endpoint-type taxonomy + HTTP-API JWT authorizer.
• CodeBuild privesc: deprecated image standard:1.0 → 7.0.
• Cognito identity pools: name AmazonCognitoUnAuthedIdentitiesSessionPolicy + intersection semantics.
• EventBridge Scheduler privesc: execution-role trust precondition + iam:PassedToService mitigation.
• Pentest permissions: SecurityAudit alternative baseline + coverage-gap note.

Detection (Section 4)

• CloudTrail: four event categories (incl. network activity); Disable Insights; key-id decode caveat.
• GuardDuty: protection plans list; Extended Threat Detection / attack sequences; ParrotLinux/PentooLinux PenTest findings; .InsideAWS severity nuance; MITRE-tactic anomaly split.
• Inspector: Classic end-of-support (May 20 2026) / inspector2 note.
• Security Hub: CSPM vs new Security Hub "exposures" distinction.

Notes / out of scope

• Pre-existing duplicate reference numbers [14]/[15] in aws-sts-privesc/README.md were left as-is (unrelated to this change).
• A few cosmetic typos spotted in passing (.opvn→.ovpn in EC2 enum; a mislabeled comment in EC2 post-exp; possibly-truncated sentences in Beanstalk post-exp; a possibly mis-targeted internal ref in ECR privesc) were not touched to keep this PR focused on factual accuracy.

QC

• Every version-sensitive claim verified against official AWS docs; new references added with source links.
• No dangling <sup> reference markers; no newly-introduced duplicate reference numbers; all code fences balanced; all {{#include}}/{{#ref}} directives preserved.

🤖 Generated with Claude Code