AWS ssm-sap documentation change
Summary
Updated service-linked role documentation by adding policy reference links and removing inline IAM policy JSON
Security assessment
The changes primarily improve documentation structure by linking to managed policies instead of embedding full JSON. No security vulnerabilities or weaknesses are mentioned. The removed policy content remains accessible via links, maintaining equivalent security transparency.
Diff
diff --git a/ssm-sap/latest/userguide/slr.md b/ssm-sap/latest/userguide/slr.md index db359dffc..a729674e1 100644 --- a//ssm-sap/latest/userguide/slr.md +++ b//ssm-sap/latest/userguide/slr.md @@ -17 +17 @@ For information about other services that support service-linked roles, see [AWS -Systems Manager for SAP uses the service-linked role named **AWSServiceRoleForAWSSSMForSAP** and associates it with the **AWSSSMForSAPServiceLinkedRolePolicy** IAM policy – Provides AWS Systems Manager for SAP the permissions required to manage and integrate SAP applications on AWS. +Systems Manager for SAP uses the service-linked role named [AWSSSMForSAPServiceLinkedRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSSMForSAPServiceLinkedRolePolicy.html) and associates it with the **AWSSSMForSAPServiceLinkedRolePolicy** IAM policy – Provides AWS Systems Manager for SAP the permissions required to manage and integrate SAP applications on AWS. @@ -42 +42 @@ This policy includes the following permissions. -The **AWSSSMForSAPServiceLinkedRolePolicy** service-linked role trusts the following services to assume the role: +The [AWSSSMForSAPServiceLinkedRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSSMForSAPServiceLinkedRolePolicy.html) service-linked role trusts the following services to assume the role: @@ -49,357 +48,0 @@ The **AWSSSMForSAPServiceLinkedRolePolicy** service-linked role trusts the follo -The following is the full policy. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DescribeInstanceActions", - "Effect": "Allow", - "Action": [ - "ec2:DescribeInstances", - "ssm:GetCommandInvocation", - "ssm:DescribeInstanceInformation" - ], - "Resource": "*" - }, - { - "Sid": "DescribeInstanceStatus", - "Effect": "Allow", - "Action": "ec2:DescribeInstanceStatus", - "Resource": "*" - }, - { - "Sid": "TargetRuleActions", - "Effect": "Allow", - "Action": [ - "events:DeleteRule", - "events:PutTargets", - "events:DescribeRule", - "events:PutRule", - "events:RemoveTargets" - ], - "Resource": [ - "arn:*:events:*:*:rule/SSMSAPManagedRule*", - "arn:*:events:*:*:event-bus/default" - ] - }, - { - "Sid": "DocumentActions", - "Effect": "Allow", - "Action": [ - "ssm:DescribeDocument", - "ssm:SendCommand" - ], - "Resource": [ - "arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*", - "arn:*:ssm:*:*:document/AWSSSMSAP*", - "arn:*:ssm:*:*:document/AWSSAP*" - ] - }, - { - "Sid": "CustomerSendCommand", - "Effect": "Allow", - "Action": "ssm:SendCommand", - "Resource": "arn:*:ec2:*:*:instance/*", - "Condition": { - "StringEqualsIgnoreCase": { - "ssm:resourceTag/SSMForSAPManaged": "True" - } - } - }, - { - "Sid": "InstanceTagActions", - "Effect": "Allow", - "Action": [ - "ec2:CreateTags", - "ec2:DeleteTags" - ], - "Resource": "arn:*:ec2:*:*:instance/*", - "Condition": { - "Null": { - "aws:RequestTag/awsApplication": "false" - }, - "StringEqualsIgnoreCase": { - "ec2:ResourceTag/SSMForSAPManaged": "True" - } - } - }, - { - "Sid": "DescribeTag", - "Effect": "Allow", - "Action": "ec2:DescribeTags", - "Resource": "*" - }, - { - "Sid": "GetApplication", - "Effect": "Allow", - "Action": "servicecatalog:GetApplication", - "Resource": "arn:*:servicecatalog:*:*:*" - }, - { - "Sid": "UpdateOrDeleteApplication", - "Effect": "Allow", - "Action": [ - "servicecatalog:DeleteApplication", - "servicecatalog:UpdateApplication" - ], - "Resource": "arn:*:servicecatalog:*:*:*", - "Condition": { - "StringEquals": { - "aws:ResourceTag/SSMForSAPCreated": "True" - } - } - }, - { - "Sid": "CreateApplication", - "Effect": "Allow", - "Action": [ - "servicecatalog:TagResource", - "servicecatalog:CreateApplication" - ], - "Resource": "arn:*:servicecatalog:*:*:*", - "Condition": { - "StringEquals": { - "aws:RequestTag/SSMForSAPCreated": "True" - } - } - }, - { - "Sid": "CreateServiceLinkedRole", - "Effect": "Allow", - "Action": "iam:CreateServiceLinkedRole", - "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry", - "Condition": { - "StringEquals": { - "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com" - } - } - }, - { - "Sid": "PutMetricData", - "Effect": "Allow", - "Action": "cloudwatch:PutMetricData", - "Resource": "*", - "Condition": { - "StringEquals": { - "cloudwatch:namespace": [ - "AWS/Usage", - "AWS/SSMForSAP" - ] - } - } - }, - { - "Sid": "CreateAttributeGroup", - "Effect": "Allow", - "Action": "servicecatalog:CreateAttributeGroup", - "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", - "Condition": { - "StringEquals": { - "aws:RequestTag/SSMForSAPCreated": "True" - } - } - }, - { - "Sid": "GetAttributeGroup", - "Effect": "Allow", - "Action": "servicecatalog:GetAttributeGroup", - "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*" - }, - { - "Sid": "DeleteAttributeGroup", - "Effect": "Allow", - "Action": "servicecatalog:DeleteAttributeGroup", - "Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*", - "Condition": { - "StringEquals": { - "aws:ResourceTag/SSMForSAPCreated": "True" - } - } - }, - { - "Sid": "AttributeGroupActions", - "Effect": "Allow", - "Action": [ - "servicecatalog:AssociateAttributeGroup", - "servicecatalog:DisassociateAttributeGroup" - ], - "Resource": "arn:*:servicecatalog:*:*:*", - "Condition": { - "StringEquals": { - "aws:ResourceTag/SSMForSAPCreated": "True" - } - } - }, - { - "Sid": "ListAssociatedAttributeGroups", - "Effect": "Allow", - "Action": "servicecatalog:ListAssociatedAttributeGroups",