AWS systems-manager documentation change
Summary
Clarified delegated administrator capabilities and limitations regarding patch policy management
Security assessment
The changes clarify administrative boundaries for patch policies but do not introduce or modify security features. The note about patch policy limitations helps prevent misconfiguration but doesn't address an active security issue
Diff
diff --git a/systems-manager/latest/userguide/quick-setup-delegated-administrator.md b/systems-manager/latest/userguide/quick-setup-delegated-administrator.md index 5ae6b7d62..f2cf88f6a 100644 --- a//systems-manager/latest/userguide/quick-setup-delegated-administrator.md +++ b//systems-manager/latest/userguide/quick-setup-delegated-administrator.md @@ -7 +7 @@ -When you register a delegated administrator account for Quick Setup, you can create, update, view, and delete Quick Setup configuration managers that target organizational units in an Organizations. You'll also be able to use the delegated administrator account to manage configuration managers created by the management account of your organization. +After you register a delegated administrator account for Quick Setup, users with the appropriate permissions in that account can create, update, view, and delete configuration managers that target organizational units within your AWS Organizations structure. This delegated administrator account can also manage configuration managers previously created by your organization's management account. @@ -9 +9 @@ When you register a delegated administrator account for Quick Setup, you can cre -The management account of an AWS Organizations organization can register one account within your organization as a delegated administrator. Wen you register an account as a delegated administrator for Quick Setup, the account is also registered as a delegated administrator for AWS CloudFormation StackSets and Explorer because these are dependent services used to deploy and monitor Quick Setup configurations. +The management account in Organizations can designate one account within your organization as a delegated administrator. When you register an account as a delegated administrator for Quick Setup, this account automatically becomes a delegated administrator for AWS CloudFormation StackSets and Systems Manager Explorer as well, since these services are required to deploy and monitor Quick Setup configurations. @@ -13 +13 @@ The management account of an AWS Organizations organization can register one acc -At this time, the patch policy configuration type isn't supported by the delegated administrator for Quick Setup. +At this time, the patch policy configuration type isn't supported by the delegated administrator for Quick Setup. Patch policy configurations for an organization must be created and maintained in the management account for an organization. For more information, see [Creating a patch policy](./quick-setup-patch-manager.html#create-patch-policy).