From 8006cc2f171fb30ab51f656bff879d640a27378f Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Tue, 11 Aug 2026 17:58:27 +1000 Subject: [PATCH] docs: SEO pass on the IAM docs cluster Rework the frontmatter titles and descriptions for the five Identity docs so each leads with the AWS concept term users actually search, and add contextual in-prose links between them. Only the roles and instance profiles page currently earns search impressions, so it now links to all four siblings and each sibling links back into the cluster. --- docs/identity/iam-groups/README.md | 12 ++++++------ .../iam-roles-and-instance-profiles/README.md | 10 +++++----- docs/identity/iam-users-and-policies/README.md | 10 +++++----- docs/identity/imds/README.md | 10 +++++----- docs/identity/sts/README.md | 10 +++++----- 5 files changed, 26 insertions(+), 26 deletions(-) diff --git a/docs/identity/iam-groups/README.md b/docs/identity/iam-groups/README.md index 5533371a3..9c522bc75 100644 --- a/docs/identity/iam-groups/README.md +++ b/docs/identity/iam-groups/README.md @@ -1,6 +1,6 @@ --- -title: "IAM Groups" -description: "Organise IAM users into groups and manage permissions once for the whole team." +title: "AWS IAM Groups for Shared User Permissions" +description: "Organise AWS IAM users into groups, manage membership, and attach managed or inline policies once for the whole team instead of granting them user by user." category: "Identity" tags: - iam @@ -15,9 +15,9 @@ resources: url: "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html" --- -# IAM Groups +# AWS IAM Groups for Shared User Permissions -> Organise IAM users into groups and manage permissions once for the whole team. +> Organise AWS IAM users into groups, manage membership, and attach managed or inline policies once for the whole team instead of granting them user by user. ## Table of Contents @@ -33,11 +33,11 @@ resources: ## Overview -A group is a collection of IAM users. Policies attached to a group apply to every member, so instead of attaching the same policy to each developer individually, you attach it once to a `developers` group and manage membership. +A group is a collection of [IAM users](/docs/iam-users-and-policies). Policies attached to a group apply to every member, so instead of attaching the same policy to each developer individually, you attach it once to a `developers` group and manage membership. Members inherit both the group's **attached managed policies** and its **inline policies**, combined with any policies on the user itself. Policy evaluation is the same as everywhere else: an explicit `Deny` in any applicable policy wins, and anything not allowed is denied. -Groups cannot be nested, and a group is not a principal — it cannot sign requests or own access keys. Like all IAM resources, groups are scoped to the account that creates them. +Groups cannot be nested, and a group is not a principal — it cannot sign requests or own access keys. The identity you assume to get credentials is an [IAM role](/docs/iam-roles-and-instance-profiles), not a group. Like all IAM resources, groups are scoped to the account that creates them. ## Prerequisites diff --git a/docs/identity/iam-roles-and-instance-profiles/README.md b/docs/identity/iam-roles-and-instance-profiles/README.md index 2adbad16f..d7449030f 100644 --- a/docs/identity/iam-roles-and-instance-profiles/README.md +++ b/docs/identity/iam-roles-and-instance-profiles/README.md @@ -1,6 +1,6 @@ --- -title: "IAM Roles and Instance Profiles" -description: "Create IAM roles with trust policies, wrap them in instance profiles, and grant EC2 instances credentials without static keys." +title: "AWS IAM Roles and Instance Profiles for EC2" +description: "Create AWS IAM roles with trust policies, wrap them in instance profiles, and launch EC2 instances that receive credentials with no static access keys at all." category: "Identity" tags: - iam @@ -18,9 +18,9 @@ resources: url: "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html" --- -# IAM Roles and Instance Profiles +# AWS IAM Roles and Instance Profiles for EC2 -> Create IAM roles with trust policies, wrap them in instance profiles, and grant EC2 instances credentials without static keys. +> Create AWS IAM roles with trust policies, wrap them in instance profiles, and launch EC2 instances that receive credentials with no static access keys at all. ## Table of Contents @@ -39,7 +39,7 @@ resources: ## Overview -A role is an IAM identity with permissions but no long-lived credentials. Instead of an access key pair, a role has a **trust policy** declaring who may assume it; whoever assumes the role receives short-lived, auto-rotating STS credentials. +A role is an IAM identity with permissions but no long-lived credentials. Unlike an [IAM group](/docs/iam-groups), which only bundles users together, a role is a principal in its own right: instead of an access key pair it has a **trust policy** declaring who may assume it, and whoever assumes the role receives short-lived, auto-rotating STS credentials. An **instance profile** is the container that binds a role to an EC2 instance. An instance launched with a profile gets the role's credentials delivered through [IMDS](/docs/imds) — no static keys baked into the image, no `~/.aws/credentials` inside the guest. diff --git a/docs/identity/iam-users-and-policies/README.md b/docs/identity/iam-users-and-policies/README.md index 1d9226bb7..2ca06fbec 100644 --- a/docs/identity/iam-users-and-policies/README.md +++ b/docs/identity/iam-users-and-policies/README.md @@ -1,6 +1,6 @@ --- -title: "IAM Users and Policies" -description: "Create IAM users, manage access keys, and control permissions with policies." +title: "AWS IAM Users, Policies, and Access Keys" +description: "Create AWS IAM users, issue and rotate access keys, and write and attach JSON policies that control exactly what each user can do in a Spinifex account." category: "Identity" tags: - iam @@ -17,9 +17,9 @@ resources: url: "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html" --- -# IAM Users and Policies +# AWS IAM Users, Policies, and Access Keys -> Create IAM users, manage access keys, and control permissions with policies. +> Create AWS IAM users, issue and rotate access keys, and write and attach JSON policies that control exactly what each user can do in a Spinifex account. ## Table of Contents @@ -119,7 +119,7 @@ aws iam delete-user --user-name alice ## Access Keys -Access keys are how users authenticate with the AWS CLI. Each user can have up to **2 access keys** at a time, allowing key rotation without downtime. +Access keys are how users authenticate with the AWS CLI. Each user can have up to **2 access keys** at a time, allowing key rotation without downtime. For credentials that expire on their own instead of a long-lived key pair, see [STS and Temporary Credentials](/docs/sts). Workloads running inside an EC2 instance should not carry a user's access key at all — they pick up role credentials automatically through [IMDS](/docs/imds). ### Create an Access Key diff --git a/docs/identity/imds/README.md b/docs/identity/imds/README.md index aa002aed6..f7e93e0ab 100644 --- a/docs/identity/imds/README.md +++ b/docs/identity/imds/README.md @@ -1,6 +1,6 @@ --- -title: "IMDS (Instance Metadata Service)" -description: "Access instance metadata, user data, and IAM role credentials from inside a guest VM with IMDSv2." +title: "AWS IMDS: Instance Metadata Service (IMDSv2)" +description: "Query AWS instance metadata, read user data, and fetch short-lived IAM role credentials from inside a guest VM using IMDSv2 session tokens on Spinifex." category: "Identity" tags: - imds @@ -18,9 +18,9 @@ resources: url: "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html" --- -# Instance Metadata Service (IMDS) +# AWS IMDS: Instance Metadata Service (IMDSv2) -> Access instance metadata, user data, and IAM role credentials from inside a guest VM with IMDSv2. +> Query AWS instance metadata, read user data, and fetch short-lived IAM role credentials from inside a guest VM using IMDSv2 session tokens on Spinifex. ## Table of Contents @@ -153,7 +153,7 @@ Returns the decoded user data, or 404 if the instance was launched without any. ## IAM Role Credentials -Instances launched with an IAM instance profile get short-lived, auto-rotating credentials through IMDS — no static keys baked into the image. Creating roles and instance profiles is covered in [IAM Roles and Instance Profiles](/docs/iam-roles-and-instance-profiles). +Instances launched with an IAM instance profile get short-lived, auto-rotating credentials through IMDS — no static keys baked into the image. Creating roles and instance profiles is covered in [IAM Roles and Instance Profiles](/docs/iam-roles-and-instance-profiles). These are the same temporary credentials [STS](/docs/sts) issues, delivered to the guest automatically instead of through an explicit `assume-role` call. ```bash # Discover the role name diff --git a/docs/identity/sts/README.md b/docs/identity/sts/README.md index 33ffcee4a..b7af6c778 100644 --- a/docs/identity/sts/README.md +++ b/docs/identity/sts/README.md @@ -1,6 +1,6 @@ --- -title: "STS and Temporary Credentials" -description: "Mint short-lived credentials with STS — assume roles, issue session tokens, and federate Kubernetes workloads with OIDC." +title: "AWS STS Temporary Credentials and AssumeRole" +description: "Use AWS STS to issue temporary credentials: assume an IAM role, request a session token, or federate Kubernetes workloads with OIDC web identity on Spinifex." category: "Identity" tags: - sts @@ -18,9 +18,9 @@ resources: url: "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html" --- -# STS and Temporary Credentials +# AWS STS Temporary Credentials and AssumeRole -> Mint short-lived credentials with STS — assume roles, issue session tokens, and federate Kubernetes workloads with OIDC. +> Use AWS STS to issue temporary credentials: assume an IAM role, request a session token, or federate Kubernetes workloads with OIDC web identity on Spinifex. ## Table of Contents @@ -43,7 +43,7 @@ STS (Security Token Service) issues **temporary credentials**: an `ASIA`-prefixe Spinifex supports the three main ways to obtain them: - **`assume-role`** — exchange your IAM user credentials for a [role's](/docs/iam-roles-and-instance-profiles) permissions, gated by the role's trust policy. -- **`get-session-token`** — get a time-boxed copy of your own user's permissions. +- **`get-session-token`** — get a time-boxed copy of your own [IAM user's](/docs/iam-users-and-policies) permissions. - **`assume-role-with-web-identity`** — exchange an OIDC ID token (a Kubernetes ServiceAccount token) for role credentials, with no IAM credentials at all. EC2 instances get role credentials a fourth way, automatically through [IMDS](/docs/imds) — no STS call needed in the guest.