AWS systems-manager documentation change
Summary
Updated ARN patterns to specify 'us-east-1' region and concrete account IDs in IAM policy examples
Security assessment
Changes standardize region/account ID placeholders but don't introduce new security controls or address vulnerabilities. Just-in-time access is a security feature, but these updates are example formatting improvements.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-just-in-time-node-access-setting-up.md b/systems-manager/latest/userguide/systems-manager-just-in-time-node-access-setting-up.md index aa3653a14..1451a9bac 100644 --- a//systems-manager/latest/userguide/systems-manager-just-in-time-node-access-setting-up.md +++ b//systems-manager/latest/userguide/systems-manager-just-in-time-node-access-setting-up.md @@ -183 +183 @@ JSON - "Resource": "arn:aws:ssm:region:account id:automation-definition/AWS-EnableExplorer:*" + "Resource": "arn:aws:ssm:us-east-1:account id:automation-definition/AWS-EnableExplorer:*" @@ -193 +193 @@ JSON - "Resource": "arn:aws:ssm:region:account id:association/*" + "Resource": "arn:aws:ssm:us-east-1:account id:association/*" @@ -202 +202 @@ JSON - "Resource": "arn:aws:ssm:region:account-id:resource-data-sync/AWS-QuickSetup-*" + "Resource": "arn:aws:ssm:us-east-1:account-id:resource-data-sync/AWS-QuickSetup-*" @@ -250 +250 @@ JSON - "arn:aws:ssm:region:account id:document/SSM-JustInTimeAccessDenyAccessOrgPolicy" + "arn:aws:ssm:us-east-1:account id:document/SSM-JustInTimeAccessDenyAccessOrgPolicy" @@ -311 +311 @@ JSON - "arn:aws:ssm:region:account id:document/*" + "arn:aws:ssm:us-east-1:account id:document/*" @@ -334 +334 @@ JSON - "Resource": "arn:aws:iam::account id:role/SSM-JustInTimeAccessTokenRole", + "Resource": "arn:aws:iam::111122223333:role/SSM-JustInTimeAccessTokenRole", @@ -365 +365 @@ JSON - "Resource": "arn:aws:ssm:region:account id:document/SSM-SessionManagerRunShell", + "Resource": "arn:aws:ssm:us-east-1:account id:document/SSM-SessionManagerRunShell", @@ -398 +398 @@ JSON - "Resource": "arn:aws:kms:region:account id:key/*", + "Resource": "arn:aws:kms:us-east-1:account id:key/*", @@ -428 +428 @@ JSON - "arn:aws:sns:region:account id:SSM-JITNA*" + "arn:aws:sns:us-east-1:account id:SSM-JITNA*" @@ -447 +447 @@ JSON - "arn:aws:events:region:account id:rule/SSM-JITNA*" + "arn:aws:events:us-east-1:account id:rule/SSM-JITNA*" @@ -490,2 +489,2 @@ JSON - "arn:aws:ssm:region:account id:servicesetting/ssm/access-request/email-role-mapping", - "arn:aws:ssm:region:account id:servicesetting/ssm/access-request/enabled-email-notifications" + "arn:aws:ssm:us-east-1:account id:servicesetting/ssm/access-request/email-role-mapping", + "arn:aws:ssm:us-east-1:account id:servicesetting/ssm/access-request/enabled-email-notifications" @@ -556 +555 @@ JSON - "Resource": "arn:aws:iam::account id:user/*" + "Resource": "arn:aws:iam::111122223333:user/*" @@ -592 +591 @@ JSON - "Resource": "arn:aws:iam::account id:role/role name", + "Resource": "arn:aws:iam::111122223333:role/role name", @@ -607 +606 @@ JSON - "Resource": "arn:aws:iam::account id:role/aws-service-role/management.chatbot.amazonaws.com/AWSServiceRoleForAWSChatbot" + "Resource": "arn:aws:iam::111122223333:role/aws-service-role/management.chatbot.amazonaws.com/AWSServiceRoleForAWSChatbot" @@ -615 +614 @@ JSON - "Resource": "arn:aws:logs:*:account id:log-group::log-stream:" + "Resource": "arn:aws:logs:*:111122223333:log-group::log-stream:" @@ -660 +659 @@ JSON - "Resource": "arn:aws:ssm:region:account id:opsitem/*" + "Resource": "arn:aws:ssm:us-east-1:account id:opsitem/*" @@ -706 +705 @@ JSON - "arn:aws:ssm:region:account id:document/*" + "arn:aws:ssm:us-east-1:account id:document/*" @@ -753 +751,2 @@ JSON - "Statement": [{ + "Statement": [ + { @@ -899 +897 @@ JSON - "arn:aws:ssm:*:account id:document/*" + "arn:aws:ssm:*:111122223333:document/*"