AWS systems-manager high security documentation change
Summary
Added documentation for just-in-time node access feature, updated managed policies related to JIT access, and minor formatting fix
Security assessment
The changes explicitly describe security improvements including temporary time-bound access to nodes (reducing attack surface) and session recording for compliance. The managed policy updates directly relate to access control mechanisms.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-release-history.md b/systems-manager/latest/userguide/systems-manager-release-history.md index acd05067b..78c0374ec 100644 --- a//systems-manager/latest/userguide/systems-manager-release-history.md +++ b//systems-manager/latest/userguide/systems-manager-release-history.md @@ -12,0 +13,4 @@ Change| Description| Date +Updated managed policy for Quick Setup: AWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicy| Systems Manager has updated the managed policy `AWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicy` to provide permissions to tag a resource shared by for just-in-time node access. For information, see [Systems Manager updates to AWS managed policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| April 29, 2025 +Updated managed policy for Quick Setup: AWSQuickSetupManageJITNAResourcesExecutionPolicy| Systems Manager has updated the managed policy `AWSQuickSetupManageJITNAResourcesExecutionPolicy` to provide permissions to tag IAM roles created for just-in-time node access. For information, see [Systems Manager updates to AWS managed policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| April 29, 2025 +Systems Manager introduces just-in-time node access| AWS Systems Manager now supports a just-in-time access method of connecting to managed nodes. This new method of connecting to managed nodes helps improve the security of your nodes by providing temporary, time-bound access to nodes only when needed, eliminating the need for long-standing permissions. Additionally, Systems Manager provides session recording for RDP sessions to Windows Server nodes to help you meet compliance requirements, perform root cause analysis, and more. For more information, see [Just-in-time node access using Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-just-in-time-node-access.html).| April 29, 2025 +New managed policies for just-in-time node access| Systems Manager has released several new managed policies to support just-in-time node access. For information, see [Systems Manager updates to AWS managed policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| April 29, 2025 @@ -41 +45 @@ New and updated managed policies for Systems Manager| To support new features fo -A new, simplified node management experience for Systems Manager| AWS Systems Manager has released a new unified console experience for managing nodes at scale across accounts and Regions. You can now see all managed and unmanaged nodes across your organizations’ AWS accounts and Regions from a single place. You can also identify, diagnose, and remediate unmanaged nodes. Systems Manager is also now integrated with (Amazon Q Developer (Amazon Q), which extends your ability to see and control your nodes from anywhere in the AWS Management Console by entering natural language prompts. With this release, you can also now use AWS Organizations to allow a delegated administrator account to manage nodes across the organization from a central viewpoint. For more information, see the following topics: +A new, simplified node management experience for Systems Manager| AWS Systems Manager has released a new unified console experience for managing nodes at scale across accounts and Regions. You can now see all managed and unmanaged nodes across your organizations’ AWS accounts and Regions from a single place. You can also identify, diagnose, and remediate unmanaged nodes. Systems Manager is also now integrated with Amazon Q Developer (Amazon Q), which extends your ability to see and control your nodes from anywhere in the AWS Management Console by entering natural language prompts. With this release, you can also now use AWS Organizations to allow a delegated administrator account to manage nodes across the organization from a central viewpoint. For more information, see the following topics: