AWS imagebuilder medium security documentation change

Service: imagebuilder · 2025-07-25 · Security-related medium

File: imagebuilder/latest/userguide/security-iam-awsmanpol.md

Summary

Added documentation about SSM Parameter Store permissions for Image Builder service role, including reading public parameters and updating private parameters prefixed with '/imagebuilder/'

Security assessment

Explicitly documents new IAM policy permissions (ssm:GetParameter and ssm:PutParameter) that control access to sensitive parameter store values. This addresses security by clarifying least-privilege access patterns for SSM parameters used in image builds.

Diff

diff --git a/imagebuilder/latest/userguide/security-iam-awsmanpol.md b/imagebuilder/latest/userguide/security-iam-awsmanpol.md
index 7ff16d64c..ee4fcedac 100644
--- a//imagebuilder/latest/userguide/security-iam-awsmanpol.md
+++ b//imagebuilder/latest/userguide/security-iam-awsmanpol.md
@@ -98,0 +99,2 @@ Image Builder is also able to create or delete State Manager associations for an
+Image Builder is able to read public Parameter Store Parameters, and read and update private Parameters prefixed with `/imagebuilder/` so that it can update the Parameter value with the output AMI IDs that Image Builder creates from a new build.
+
@@ -213,0 +216,6 @@ Change | Description | Date
+AWSServiceRoleForImageBuilder – Update to an existing policy |  Image Builder made the following changes to the service role to support the use of AWS Systems Manager (SSM) Parameter Store Parameters in recipes and during image distribution.
+
+  * Added ssm:GetParameter to allow Image Builder to read public SSM Parameters and private SSM Parameters prefixed with `/imagebuilder/` so that they can be used in recipes.
+  * Added ssm:PutParameter to allow Image Builder to update private SSM Parameters prefixed with `/imagebuilder/` with the output AMI IDs that Image Builder creates from a new build.
+
+| July 23, 2025