AWS systems-manager documentation change

Service: systems-manager · 2025-05-16 · Documentation medium

File: systems-manager/latest/userguide/monitoring-sns-notifications.md

Summary

Added IAM policy examples for encrypted and unencrypted SNS topics, including KMS permissions for encrypted topics

Security assessment

The change adds documentation about required KMS permissions (kms:GenerateDataKey, kms:Decrypt) when using encrypted SNS topics, which relates to security best practices for encryption. However, there's no evidence this addresses a specific existing security vulnerability.

Diff

diff --git a/systems-manager/latest/userguide/monitoring-sns-notifications.md b/systems-manager/latest/userguide/monitoring-sns-notifications.md
index 9609848b1..0752be0cc 100644
--- a//systems-manager/latest/userguide/monitoring-sns-notifications.md
+++ b//systems-manager/latest/userguide/monitoring-sns-notifications.md
@@ -127 +127,4 @@ Use the following procedure to create a custom AWS Identity and Access Managemen
-  4. Replace the default content with the following.
+  4. Replace the default content with one of the following, depending on whether the Amazon SNS topic uses AWS KMS encryption:
+
+SNS topic not encrypted
+    
@@ -147,0 +151,36 @@ Use the following procedure to create a custom AWS Identity and Access Managemen
+SNS topic encrypted
+    
+    
+        {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "sns:Publish"
+                ],
+                "Resource": "arn:aws:sns:region:account-id:sns-topic-name"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "kms:GenerateDataKey",
+                    "kms:Decrypt"
+                ],
+                "Resource": "arn:aws:kms:region:account-id:key/kms-key-id"
+            }
+        ]
+    }
+
+`region` represents the identifier for an AWS Region supported by AWS Systems Manager, such as `us-east-2` for the US East (Ohio) Region. For a list of supported `region` values, see the **Region** column in [Systems Manager service endpoints](https://docs.aws.amazon.com/general/latest/gr/ssm.html#ssm_region) in the _Amazon Web Services General Reference_.
+
+``account-id`` represents the 12-digit identifier for your AWS account, in the format `123456789012`. 
+
+`sns-topic-name` represents the name of the Amazon SNS topic you want to use for publishing notifications.
+
+`kms-key-id` represents the ID of the symmetric encryption KMS key in AWS KMS to use for encrypting and decrypting the topic, in the format `1234abcd-12ab-34cd-56ef-12345EXAMPLE`.
+
+###### Note
+
+There is a charge for using AWS KMS encryption. For more information, see [Managing Amazon SNS encryption keys and costs](https://docs.aws.amazon.com/sns/latest/dg/sns-key-management.html) in the _AWS Key Management Service Developer Guide_.
+