AWS systems-manager high security documentation change

Service: systems-manager · 2025-05-10 · Security-related high

File: systems-manager/latest/userguide/compliance-permissions.md

Summary

Updated IAM policy variables from `${aws:ResourceARN}` to service-specific context keys (e.g., `${ec2:SourceInstanceARN}`).

Security assessment

Corrects policy variable usage to ensure proper enforcement of IAM conditions, preventing potential unauthorized access due to misconfiguration.

Diff

diff --git a/systems-manager/latest/userguide/compliance-permissions.md b/systems-manager/latest/userguide/compliance-permissions.md
index 8e101f79b..d588edadc 100644
--- a//systems-manager/latest/userguide/compliance-permissions.md
+++ b//systems-manager/latest/userguide/compliance-permissions.md
@@ -23 +23 @@ If your node is an Amazon EC2 instance, you must update the IAM instance profile
-                        "ec2:SourceInstanceARN": "${aws:ResourceARN}"
+                        "ec2:SourceInstanceARN": "${ec2:SourceInstanceARN}"
@@ -35 +35 @@ If your node is an Amazon EC2 instance, you must update the IAM instance profile
-                        "ssm:SourceInstanceARN": "${aws:ResourceARN}"
+                        "ssm:SourceInstanceARN": "${ssm:SourceInstanceARN}"