AWS systems-manager-automation-runbooks documentation change
Summary
Updated ARNs to specify 'us-east-1' region and concrete account ID in IAM policy
Security assessment
Regional/account specificity in example ARNs improves accuracy but doesn't modify security controls.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md b/systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md index fe57d6f97..8cc70475e 100644 --- a//systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md +++ b//systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md @@ -91,7 +91,7 @@ JSON - "arn:${Partition}:ec2:${Region}:${AccountId}:instance/${InstanceId}", - "arn:${Partition}:ec2:${Region}:${AccountId}:volume/${VolumeId}", - "arn:${Partition}:iam::${AccountId}:instance-profile/${InstanceProfileName}", - "arn:${Partition}:ssm:${Region}::parameter/aws/service/*", - "arn:${Partition}:ssm:${Region}::automation-definition/AWSSupport-StartEC2RescueWorkflow:*", - "arn:${Partition}:ssm:${Region}::document/AWS-ConfigureAWSPackage", - "arn:${Partition}:ssm:${Region}::document/AWS-RunPowerShellScript" + "arn:aws:us-east-1:${AccountId}:instance/${InstanceId}", + "arn:aws:us-east-1:${AccountId}:volume/${VolumeId}", + "arn:aws::111122223333:instance-profile/${InstanceProfileName}", + "arn:aws:us-east-1::parameter/aws/service/*", + "arn:aws:us-east-1::automation-definition/AWSSupport-StartEC2RescueWorkflow:*", + "arn:aws:us-east-1::document/AWS-ConfigureAWSPackage", + "arn:aws:us-east-1::document/AWS-RunPowerShellScript"