AWS systems-manager medium security documentation change

Service: systems-manager · 2025-07-16 · Security-related medium

File: systems-manager/latest/userguide/automation-tutorial-update-patch-golden-ami.md

Summary

Updated IAM resource ARNs to use account placeholder, added JSON blocks, and modified logging resource patterns

Security assessment

Changed from hardcoded account numbers to 'arn:aws:logs:region::*' pattern, which enforces better security practices by avoiding explicit account IDs. Added security-relevant documentation about parameter handling.

Diff

diff --git a/systems-manager/latest/userguide/automation-tutorial-update-patch-golden-ami.md b/systems-manager/latest/userguide/automation-tutorial-update-patch-golden-ami.md
index daafc59a9..cb6f8f3e2 100644
--- a//systems-manager/latest/userguide/automation-tutorial-update-patch-golden-ami.md
+++ b//systems-manager/latest/userguide/automation-tutorial-update-patch-golden-ami.md
@@ -56,0 +57,6 @@ Use the following procedure to create an IAM service role for AWS Lambda. These
+JSON
+    
+
+****
+    
+    
@@ -63 +69 @@ Use the following procedure to create an IAM service role for AWS Lambda. These
-                "Resource": "arn:aws:logs:region:123456789012:*"
+                "Resource": "arn:aws:logs:region::*"
@@ -72 +78 @@ Use the following procedure to create an IAM service role for AWS Lambda. These
-                    "arn:aws:logs:region:123456789012:log-group:/aws/lambda/function name:*"
+                    "arn:aws:logs:region::log-group:/aws/lambda/function name:*"
@@ -91,0 +99,6 @@ Use the following procedure to create an IAM service role for AWS Lambda. These
+JSON
+    
+
+****
+    
+    
@@ -98 +111 @@ Use the following procedure to create an IAM service role for AWS Lambda. These
-                "Resource": "arn:aws:ssm:region:123456789012:parameter/latestAmi"
+                "Resource": "arn:aws:ssm:region::parameter/latestAmi"