AWS systems-manager medium security documentation change
Summary
Added Slack notification requirements, IAM permission details for approval workflows, and trust policy for Chatbot service
Security assessment
Added requirements for Slack channel permissions and explicit IAM policies ensure secure integration with Chatbot. The trust policy addition prevents unauthorized service access, addressing potential privilege escalation risks.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-just-in-time-node-access-notifications.md b/systems-manager/latest/userguide/systems-manager-just-in-time-node-access-notifications.md index c110b5eeb..34ab2b878 100644 --- a//systems-manager/latest/userguide/systems-manager-just-in-time-node-access-notifications.md +++ b//systems-manager/latest/userguide/systems-manager-just-in-time-node-access-notifications.md @@ -9 +9,10 @@ You can configure Systems Manager to send notifications when a user creates a ju -If you're using IAM roles to manage user identities in your organization, you must manually associate the email addresses of the approvers or requesters you want to send notifications to with the associated role. Otherwise the intended recipients can't be notified by email. The following procedures describe how to configure notifications for just-in-time node access requests. +###### Before you begin + +Before you configure a chat client for just-in-time node access notifications, note the following requirement: + + * If you're using IAM roles to manage user identities in your account, you must manually associate the email addresses of the approvers or requesters you want to send notifications to with the associated role. Otherwise the intended recipients can't be notified by email. + + + + +The following procedures describe how to configure notifications for just-in-time node access requests. @@ -27 +36,8 @@ If you're using IAM roles to manage user identities in your organization, you mu - 8. Select **Configure channel**. + 8. If you're configuring Slack notifications, invite "@Amazon Q" to every Slack channel that notifications are being configured in. + + 9. Select **Configure channel**. + + + + +###### Note @@ -28,0 +45 @@ If you're using IAM roles to manage user identities in your organization, you mu +To allow approving/rejecting access requests directly from a Slack channel, make sure the IAM role that is configured with the Slack channel has `ssm:SendAutomationSignal` permissions and has a trust policy that includes chatbot: @@ -30,0 +48,7 @@ If you're using IAM roles to manage user identities in your organization, you mu + { + "Effect": "Allow", + "Principal": { + "Service": "chatbot.amazonaws.com" + }, + "Action": "sts:AssumeRole" + }