Merge pull request #2561 from EyalGur74/docs-editor/containers-permissions-1772093965

Update containers-permissions.md

Author: Carolyn135

articles/defender-for-cloud/containers-permissions.md

@@ -44,45 +44,38 @@ The Azure Arc built-in role **Defender Kubernetes Agent Operator** to provision
 
 ## AWS Agentless threat protection permissions
 
-- AzureDefenderKubernetesRole:
-  - sts:AssumeRole
-  - sts:AssumeRoleWithWebIdentity
-  - logs:PutSubscriptionFilter
-  - logs:DescribeSubscriptionFilters
-  - logs:DescribeLogGroups
-  - logs:PutRetentionPolicy
-  - firehose:*
-  - iam:PassRole
-  - eks:UpdateClusterConfig
-  - eks:DescribeCluster
-  - eks:CreateAccessEntry
-  - eks:ListAccessEntries
-  - eks:AssociateAccessPolicy
-  - eks:ListAssociatedAccessPolicies
-  - sqs:*
-  - s3:*
+- AzureDefenderKubernetesRole (default role name: **MDCContainersK8sRole**): 
 
-- AzureDefenderKubernetesScubaReaderRole (default role name: **MDCContainersK8sDataCollectionRole**):
 - sts:AssumeRole
 - sts:AssumeRoleWithWebIdentity
-- sqs:ReceiveMessage
-- sqs:DeleteMessage
-- s3:GetObject
-- s3:GetBucketLocation
-
-- AzureDefenderCloudWatchToKinesisRole (default role name: **MDCContainersK8sCloudWatchToKinesisRole**):
-- sts:AssumeRole
+- logs:PutSubscriptionFilter
+- logs:DescribeSubscriptionFilters
+- logs:DescribeLogGroups
+- logs:PutRetentionPolicy
 - firehose:*
+- iam:PassRole
+- eks:UpdateClusterConfig
+- eks:DescribeCluster
+- eks:CreateAccessEntry
+- eks:ListAccessEntries
+- eks:AssociateAccessPolicy
+- eks:ListAssociatedAccessPolicies
+- sqs:*
+- s3:*
 
-- AzureDefenderKinesisToS3Role (default role name: **MDCContainersK8sKinesisToS3Role**):
-- sts:AssumeRole
-- s3:AbortMultipartUpload
-- s3:GetBucketLocation
-- s3:GetObject
-- s3:ListBucket
-- s3:ListBucketMultipartUploads
-- s3:PutObject
+- AzureDefenderKubernetesScubaReaderRole (default role name: **MDCContainersK8sDataCollectionRole**):
+  - sts:AssumeRole
+   - sts:AssumeRoleWithWebIdentity
+   - sqs:ReceiveMessage
+   - sqs:DeleteMessage
+   - s3:GetObject
+   - s3:GetBucketLocation
 
+- AzureDefenderCloudWatchToKinesisRole (default role name: **MDCContainersK8sCloudWatchToKinesisRole**):
+  - sts:AssumeRole
+  - firehose:*
+    
+- AzureDefenderKinesisToS3Role (default role name: **MDCContainersK8sKinesisToS3Role**):
 - MDCContainersAgentlessDiscoveryK8sRole
   - sts:AssumeRoleWithWebIdentity
   - eks:UpdateClusterConfig
@@ -179,4 +172,4 @@ The following tables show the permissions granted to certain Defender for Contai
 
 ## Next steps
 
-- [Containers support matrix in Defender for Cloud](support-matrix-defender-for-containers.md)
+- [Containers support matrix in Defender for Cloud](support-matrix-defender-for-containers.md)