AWS systems-manager high security documentation change

Service: systems-manager · 2025-06-19 · Security-related high

File: systems-manager/latest/userguide/quick-setup-getting-started.md

Summary

Restructured IAM permissions with service-specific conditions

Security assessment

Implements scoped permissions with iam:PassedToService condition to prevent privilege escalation

Diff

diff --git a/systems-manager/latest/userguide/quick-setup-getting-started.md b/systems-manager/latest/userguide/quick-setup-getting-started.md
index e338c4f33..f0d5a76ee 100644
--- a//systems-manager/latest/userguide/quick-setup-getting-started.md
+++ b//systems-manager/latest/userguide/quick-setup-getting-started.md
@@ -126 +125,0 @@ To use the new Quick Setup console, you must have permissions for the following
-                    "iam:PassRole",
@@ -133,0 +133,10 @@ To use the new Quick Setup console, you must have permissions for the following
+            {
+                "Effect": "Allow",
+                "Action": "iam:PassRole",
+                "Resource": "arn:aws:iam::account-id:role/AWS-QuickSetup-*",
+                "Condition": {
+                    "StringEquals": {
+                        "iam:PassedToService": "ssm-quicksetup.amazonaws.com"
+                    }
+                }
+            },