AWS systems-manager medium security documentation change
Summary
Expanded documentation about RDP connection recording configuration, including S3 bucket encryption requirements, IAM permissions, status values, and explicit guidance for KMS key policies. Added example KMS key policy for ssm-guiconnect service principal access.
Security assessment
The changes explicitly address security controls for encryption and access management. The addition of required KMS key policies (including GenerateDataKey permissions for ssm-guiconnect) and warnings about misconfigurations that could lead to ProcessingError status (e.g., missing S3/KMS permissions) demonstrate security-focused documentation. The clarification about using separate keys for temporary encryption vs bucket encryption also relates to security best practices.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-just-in-time-node-access-rdp-recording.md b/systems-manager/latest/userguide/systems-manager-just-in-time-node-access-rdp-recording.md index d8d97ff62..5385114c5 100644 --- a//systems-manager/latest/userguide/systems-manager-just-in-time-node-access-rdp-recording.md +++ b//systems-manager/latest/userguide/systems-manager-just-in-time-node-access-rdp-recording.md @@ -5 +5 @@ -Configuring IAM permissions for recording RDP connections +Configuring S3 bucket encryption for RDP recordingsConfiguring IAM permissions for recording RDP connectionsEnabling and configuring RDP connection recordingRDP connection recording status values @@ -9 +9,29 @@ Configuring IAM permissions for recording RDP connections -Just-in-time node access includes the ability to record RDP connections made to your Windows Server nodes. Recording RDP connections requires an S3 bucket and an AWS Key Management Service (AWS KMS) customer managed key. The KMS key is used to temporarily encrypt the recording data while it's generated and stored on Systems Manager resources. The recording uploaded to your S3 bucket isn't encrypted with this key. The customer managed key must be a symmetric key with a key usage of encrypt and decrypt. You can either use a multi-Region key for your organization, or you must create a customer managed key in each Region where you've enabled just-in-time node access. +Just-in-time node access includes the ability to record RDP connections made to your Windows Server nodes. Recording RDP connections require an S3 bucket and an AWS Key Management Service (AWS KMS) customer managed key. The AWS KMS key is used to temporarily encrypt the recording data while it's generated and stored on Systems Manager resources. The customer managed key must be a symmetric key with a key usage of encrypt and decrypt. You can either use a multi-Region key for your organization, or you must create a customer managed key in each Region where you've enabled just-in-time node access. + +If you have enabled KMS encryption on the S3 bucket where you store recordings, you must provide access to the customer managed key used for bucket encryption to the `ssm-guiconnect` service principal. This customer managed key can be a different one than you specify in the recording settings, which must include for which the `kms:CreateGrant` permission is required for establishing connections. + +## Configuring S3 bucket encryption for RDP recordings + +Your connection recordings are stored in the S3 bucket that you specify when you enable RDP recording. + +If you use a KMS key as the default encryption mechanism for the S3 bucket (SSE-KMS), you must allow the `ssm-guiconnect` service principal access to `kms:GenerateDataKey` action on the key. We recommend using a customer managed key when using SSE-KMS encryption with S3 bucket. This is because you can update the associated key policy for a customer managed key. You can't update the key policies for AWS managed keys. + +Following is an example of the policy which can be used to allow the `ssm-guiconnect` service access to the KMS key for S3 storage. For information about updating a customer managed key, see [Change a key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying.html) in the _AWS Key Management Service Developer Guide_. + + + { + "Sid": "Allow the GUI Connect service principal to access S3", + "Effect": "Allow", + "Principal": { + "Service": "ssm-guiconnect.amazonaws.com" + }, + "Action": [ + "kms:GenerateDataKey*" + ], + "Resource": "*", + "Condition": { + "StringEquals": { + "kms:ViaService": "s3.us-east-1.amazonaws.com" + } + } + } @@ -48,0 +77,2 @@ To store your connection recordings, you must first create an S3 bucket and add +(For information about adding a bucket policy, see [Adding a bucket policy by using the Amazon S3 console](https://docs.aws.amazon.com/AmazonS3/latest/userguide/add-bucket-policy.html) in the _Amazon Simple Storage Service User Guide_.) + @@ -75 +105 @@ To store your connection recordings, you must first create an S3 bucket and add -For more information about adding a bucket policy, see [Adding a bucket policy by using the Amazon S3 console](https://docs.aws.amazon.com/AmazonS3/latest/userguide/add-bucket-policy.html) in the _Amazon Simple Storage Service User Guide_. +## Enabling and configuring RDP connection recording @@ -79 +109 @@ The following procedure describes how to enable and configure RDP connection rec -###### To configure RDP connection recording +###### To enable and configure RDP connection recording @@ -91 +121 @@ The following procedure describes how to enable and configure RDP connection rec - 6. Choose the customer managed key you want to use to temporarily encrypt the recording data while it's generated and stored on Systems Manager resources. The recording uploaded to your S3 bucket isn't encrypted with this key. + 6. Choose the customer managed key you want to use to temporarily encrypt the recording data while it's generated and stored on Systems Manager resources. (This can be a different customer managed key than you use to encrypt the bucket.) @@ -97,0 +128,21 @@ The following procedure describes how to enable and configure RDP connection rec +## RDP connection recording status values + +Valid status values for RPD connection recordings include the following: + + * `Recording` \- The connection is in the process of being recorded + + * `Processing` \- The video is being processed after the connection is terminated. + + * `Finished` \- Successful terminal state:The connection recording video processed successfully and uploaded to the specified bucket. + + * `Failed` \- Failed terminal state. The connection wasn't recorded successfully. + + * `ProcessingError` \- One or more intermediate failures/errors occurred during video processing. Potential causes include service dependency failures or missing permissions due to a misconfiguration on the S3 bucket specified for storing recordings. The service continues to attempt processing when the recording is in this state. + + + + +###### Note + +`ProcessingError` can be the result of the `ssm-guiconnect` service principal not having permission to upload objects to the S3 bucket after the connection has been established. Another potential cause is missing KMS permissions on the KMS key used for S3 bucket encryption. +