AWS systems-manager-automation-runbooks medium security documentation change
Summary
Updated parameters and IAM permissions for IP monitoring automation. Added security group, instance profile, and retention options. Modified IAM policy actions/resources and added security warning about IAM permissions.
Security assessment
Added explicit security warning recommending use of TestInstanceProfileName to prevent misuse of mutable IAM permissions. Modified IAM permissions to include more granular actions like iam:DeleteRolePolicy and iam:TagRole. Security group guidance and instance profile recommendations help reduce overprivileged resources.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md b/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md index fcb300c14..a885889c9 100644 --- a//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md +++ b//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md @@ -45 +45 @@ Type: String -Default: / `AWSSupport-SetupIPMonitoringFromVPC` +Default: `/AWSSupport-SetupIPMonitoringFromVPC` @@ -65 +65 @@ Valid values: t2.micro | t2.small | t2.medium | t2.large | t3.micro | t3.small | -Default: t2.micro +Default: t3.micro @@ -67 +67 @@ Default: t2.micro -Description: (Optional) The EC2 instance type for the EC2Rescue instance. Recommended size: t2.micro. +Description: (Optional) The EC2 instance type for the EC2Rescue instance. Recommended size: t3.micro. @@ -80,0 +81,24 @@ Description: (Required) Comma separated list of IPv4s and/or IPv6s to monitor. N + * TestInstanceSecurityGroupId + +Type: String + +Description: (Optional) The security group ID for the test instance. If not specified, the automation creates one during the instance creation. Make sure the security group allows outbound access to the monitoring IPs. + + * TestInstanceProfileName + +Type: String + +Description: (Optional) The name of an existing IAM instance profile for the test instance. If not specified, the automation creates one during the instance creation. The role must have the following permissions: `logs:CreateLogStream`, `logs:DescribeLogGroups`, `logs:DescribeLogStreams`, and `logs:PutLogEvents` and the AWS Managed Policy `AmazonSSMManagedInstanceCore`. + + * TestInterval + +Type: String + +Description: (Optional) The number of minutes between test intervals. The default value is `1` minute and the maximum is `10` minutes. + + * RetainDashboardAndLogsOnDeletion + +Type: String + +Description: (Optional) Specify `False` to delete the Amazon CloudWatch dashboard and Logs when deleting the AWS CloudFormation stack. The default value is `True`. By default, the dashboard and logs are retained and will need to be manually deleted when they are no longer needed. + @@ -87,0 +112,4 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r +###### Warning + +It is recommended to pass `TestInstanceProfileName` parameter or ensure security guardrails in place to prevent misuse of mutable IAM permissions. + @@ -103,0 +132 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto + "iam:GetRolePolicy", @@ -105,0 +135 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto + "iam:DeleteRolePolicy", @@ -108,25 +138 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto - "iam:DeleteRolePolicy" - ], - "Resource": [ - "arn:aws:iam:: - AWS_account_ID - :role/AWSSupport/SetupIPMonitoringFromVPC_*", - "arn:aws:iam:: - AWS_account_ID - :instance-profile/AWSSupport/SetupIPMonitoringFromVPC_*" - ], - "Effect": "Allow" - }, - { - "Action": [ - "iam:DetachRolePolicy", - "iam:AttachRolePolicy" - ], - "Resource": [ - "arn:aws:iam::aws:policy/service-role/AmazonSSMManagedInstanceCore" - ], - "Effect": "Allow" - }, - { - "Action": [ - "cloudwatch:DeleteDashboards" + "iam:TagRole" @@ -135 +141,2 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto - "*" + "arn:<partition>:iam::<account-id>:role/SetupIPMonitoringFromVPC*", + "arn:<partition>:iam::<account-id>:instance-profile/SetupIPMonitoringFromVPC*" @@ -140,0 +148,7 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto + "cloudformation:CreateStack", + "cloudformation:CreateChangeSet", + "cloudformation:DeleteStack", + "cloudformation:DescribeStacks", + "cloudformation:DescribeStackEvents", + "cloudwatch:PutDashboard", + "cloudwatch:DeleteDashboards", @@ -142,0 +157 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto + "ec2:CreateLaunchTemplate", @@ -143,0 +159 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto + "ec2:DescribeImages", @@ -145,0 +162,3 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto + "ec2:DescribeVpcs", + "ec2:DeleteLaunchTemplate", + "ec2:DeleteSecurityGroup", @@ -148 +167 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto - "ec2:DescribeInstanceStatus" + "ec2:DescribeInstanceStatus", @@ -153,9 +172,9 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto - "ec2:DescribeSecurityGroups" - ], - "Resource": [ - "*" - ], - "Effect": "Allow" - }, - { - "Action": [ + "ec2:DescribeSecurityGroups", + "ec2:DescribeLaunchTemplates", + "ec2:RevokeSecurityGroupEgress", + "logs:CreateLogGroup", + "logs:DeleteLogGroup", + "logs:PutMetricFilter", + "logs:PutRetentionPolicy", + "logs:TagResource", + "ssm:DescribeInstanceInformation", @@ -162,0 +182 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto + "ssm:GetParameters", @@ -165 +185 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto - "ssm:ListCommandInvocations", + "ssm:ListCommandInvocations" @@ -175,0 +196,23 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto +If the `TestInstanceProfileName` parameter is provided, the following IAM permissions are not required to execute the runbook: + + * iam:CreateRole + + * iam:CreateInstanceProfile + + * iam:DetachRolePolicy + + * iam:AttachRolePolicy + + * iam:AddRoleToInstanceProfile + + * iam:RemoveRoleFromInstanceProfile + + * iam:DeleteRole + + * iam:DeleteRolePolicy + + * iam:DeleteInstanceProfile + + + +