AWS systems-manager-automation-runbooks high security documentation change

Service: systems-manager-automation-runbooks · 2025-06-19 · Security-related high

File: systems-manager-automation-runbooks/latest/userguide/awssupport-validate-fsxwindows-adconfig.md

Summary

Restricted IAM PassRole resource to specific role ARN pattern

Security assessment

Limiting PassRole permissions to specific role patterns reduces risks of unintended role assumption, addressing potential privilege escalation vectors.

Diff

diff --git a/systems-manager-automation-runbooks/latest/userguide/awssupport-validate-fsxwindows-adconfig.md b/systems-manager-automation-runbooks/latest/userguide/awssupport-validate-fsxwindows-adconfig.md
index 95af9362d..7900caa03 100644
--- a//systems-manager-automation-runbooks/latest/userguide/awssupport-validate-fsxwindows-adconfig.md
+++ b//systems-manager-automation-runbooks/latest/userguide/awssupport-validate-fsxwindows-adconfig.md
@@ -353,0 +354 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r
+                                "Sid": "AllowPassRoleToEC2",
@@ -356 +357 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r
-                                "Resource": "*",
+                                "Resource": "arn:*:iam::*:role/AWSSupport-ValidateFSxWindowsADConfig-*",