AWS systems-manager documentation change
Summary
Added two new AWS managed policies (AWSQuickSetupStartStopInstancesExecutionPolicy and AWSQuickSetupStartSSMAssociationsExecutionPolicy) with permissions for instance management and SSM associations. Updated documentation for existing policies with more detailed permission descriptions.
Security assessment
The changes introduce new IAM policies and clarify existing permissions but do not address any specific security vulnerability. The documentation improvements help users understand security controls but don't indicate a security fix. The new policies enable automation capabilities rather than patching vulnerabilities.
Diff
diff --git a/systems-manager/latest/userguide/security-iam-awsmanpol.md b/systems-manager/latest/userguide/security-iam-awsmanpol.md index 17aa38a73..a02995ff0 100644 --- a//systems-manager/latest/userguide/security-iam-awsmanpol.md +++ b//systems-manager/latest/userguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AmazonSSMServiceRolePolicyAmazonSSMAutomationRoleAmazonSSMReadOnlyAccessAWSSystemsManagerOpsDataSyncServiceRolePolicyAmazonSSMManagedEC2InstanceDefaultPolicySSMQuickSetupRolePolicyAWSQuickSetupDeploymentRolePolicyAWSQuickSetupPatchPolicyDeploymentRolePolicyAWSQuickSetupPatchPolicyBaselineAccessAWSSystemsManagerEnableExplorerExecutionPolicyAWSSystemsManagerEnableConfigRecordingExecutionPolicyAWSQuickSetupDevOpsGuruPermissionsBoundaryAWSQuickSetupDistributorPermissionsBoundaryAWSQuickSetupSSMHostMgmtPermissionsBoundaryAWSQuickSetupPatchPolicyPermissionsBoundaryAWSQuickSetupSchedulerPermissionsBoundaryAWSQuickSetupCFGCPacksPermissionsBoundaryAWS-SSM-DiagnosisAutomation-AdministrationRolePolicyAWS-SSM-DiagnosisAutomation-ExecutionRolePolicyAWS-SSM-RemediationAutomation-AdministrationRolePolicyAWS-SSM-RemediationAutomation-ExecutionRolePolicyAWSQuickSetupSSMManageResourcesExecutionPolicyAWSQuickSetupSSMLifecycleManagementExecutionPolicyAWSQuickSetupSSMDeploymentRolePolicyAWSQuickSetupSSMDeploymentS3BucketRolePolicyAWSQuickSetupEnableDHMCExecutionPolicyAWSQuickSetupEnableAREXExecutionPolicyAWSQuickSetupManagedInstanceProfileExecutionPolicyAWSQuickSetupFullAccessAWSQuickSetupReadOnlyAccessAWSQuickSetupManageJITNAResourcesExecutionPolicyAWSQuickSetupJITNADeploymentRolePolicyAWSSystemsManagerJustInTimeAccessServicePolicyAWSSystemsManagerJustInTimeAccessTokenPolicyAWSSystemsManagerJustInTimeAccessTokenSessionPolicyAWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicyAWSSystemsManagerNotificationsServicePolicyAWS-SSM-Automation-DiagnosisBucketPolicyAWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicyAWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicyPolicy updatesAdditional managed policies for Systems Manager +AmazonSSMServiceRolePolicyAmazonSSMAutomationRoleAmazonSSMReadOnlyAccessAWSSystemsManagerOpsDataSyncServiceRolePolicyAmazonSSMManagedEC2InstanceDefaultPolicySSMQuickSetupRolePolicyAWSQuickSetupDeploymentRolePolicyAWSQuickSetupPatchPolicyDeploymentRolePolicyAWSQuickSetupPatchPolicyBaselineAccessAWSSystemsManagerEnableExplorerExecutionPolicyAWSSystemsManagerEnableConfigRecordingExecutionPolicyAWSQuickSetupDevOpsGuruPermissionsBoundaryAWSQuickSetupDistributorPermissionsBoundaryAWSQuickSetupSSMHostMgmtPermissionsBoundaryAWSQuickSetupPatchPolicyPermissionsBoundaryAWSQuickSetupSchedulerPermissionsBoundaryAWSQuickSetupCFGCPacksPermissionsBoundaryAWSQuickSetupStartStopInstancesExecutionPolicyAWSQuickSetupStartSSMAssociationsExecutionPolicyAWS-SSM-DiagnosisAutomation-AdministrationRolePolicyAWS-SSM-DiagnosisAutomation-ExecutionRolePolicyAWS-SSM-RemediationAutomation-AdministrationRolePolicyAWS-SSM-RemediationAutomation-ExecutionRolePolicyAWSQuickSetupSSMManageResourcesExecutionPolicyAWSQuickSetupSSMLifecycleManagementExecutionPolicyAWSQuickSetupSSMDeploymentRolePolicyAWSQuickSetupSSMDeploymentS3BucketRolePolicyAWSQuickSetupEnableDHMCExecutionPolicyAWSQuickSetupEnableAREXExecutionPolicyAWSQuickSetupManagedInstanceProfileExecutionPolicyAWSQuickSetupFullAccessAWSQuickSetupReadOnlyAccessAWSQuickSetupManageJITNAResourcesExecutionPolicyAWSQuickSetupJITNADeploymentRolePolicyAWSSystemsManagerJustInTimeAccessServicePolicyAWSSystemsManagerJustInTimeAccessTokenPolicyAWSSystemsManagerJustInTimeAccessTokenSessionPolicyAWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicyAWSSystemsManagerNotificationsServicePolicyAWS-SSM-Automation-DiagnosisBucketPolicyAWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicyAWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicyPolicy updatesAdditional managed policies for Systems Manager @@ -52,0 +53,4 @@ For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM + * AWS managed policy: AWSQuickSetupStartStopInstancesExecutionPolicy + + * AWS managed policy: AWSQuickSetupStartSSMAssociationsExecutionPolicy + @@ -411 +415 @@ This policy includes the following permissions. - * `iam` – Allows principals to manage and delete IAM roles required for Automation configuration tasks; and to manage Automation role policies. + * `ssm` – Allows principals to read, create, update, and delete SSM documents with names beginning with "AWSQuickSetup-" or "AWSOperationsPack-" when called via AWS CloudFormation; to read specific AWS owned documents including "AWSQuickSetupType-ManageInstanceProfile"; to create, update, and delete associations for Quick Setup documents and AWS owned documents when called via AWS CloudFormation; and to clean up legacy resources tagged with `QuickSetupID`. This enables Quick Setup to deploy and manage automation workflows and associations. @@ -413 +417 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to create and manage stack sets. + * `cloudformation` – Allows principals to read information about AWS CloudFormation stacks and stack sets; and to create, update, and delete AWS CloudFormation stacks and change sets for resources with names beginning with "StackSet-AWS-QuickSetup-". This enables Quick Setup to manage infrastructure deployments across accounts and regions. @@ -415 +419 @@ This policy includes the following permissions. - * `config` – Allows principals to create, manage, and delete conformance packs. + * `config` – Allows principals to read information about AWS Config conformance packs and their status; and to create and delete conformance packs with names beginning with "AWS-QuickSetup-" when called via AWS CloudFormation. This enables Quick Setup to deploy compliance monitoring configurations. @@ -417 +421 @@ This policy includes the following permissions. - * `events` – Allows principals to create, update, and delete event rules for scheduled actions. + * `events` – Allows principals to manage EventBridge rules and targets for resources with names containing "QuickSetup-". This enables Quick Setup to create scheduled automation workflows. @@ -419 +423 @@ This policy includes the following permissions. - * `resource-groups` – Allows principals to retrieve resource queries that are associated with resource groups targeted by Quick Setup configurations. + * `iam` – Allows principals to create service-linked roles for AWS Config and Systems Manager; to create, manage, and delete IAM roles with names beginning with "AWS-QuickSetup-" or "AWSOperationsPack-" when called via AWS CloudFormation; to pass these roles to Systems Manager and EventBridge services; to attach specific AWS managed policies to these roles; and to set permissions boundaries using specific Quick Setup managed policies. This enables Quick Setup to create the necessary service roles for its operations. @@ -421 +425 @@ This policy includes the following permissions. - * `ssm` – Allows principals to create Automation runbooks and associations that apply Quick Setup configurations. + * `resource-groups` – Allows principals to retrieve resource group queries. This enables Quick Setup to target specific sets of resources for configuration management. @@ -743,0 +748,40 @@ To view more details about the policy, including the latest version of the JSON +## AWS managed policy: AWSQuickSetupStartStopInstancesExecutionPolicy + +You can attach `AWSQuickSetupStartStopInstancesExecutionPolicy` to your IAM entities. This policy provides permissions for Quick Setup to manage the starting and stopping of Amazon EC2 instances using Systems Manager automation. + +**Permissions details** + +This policy includes the following permissions. + + * `ec2` – Allows principals to view detailed information about Amazon EC2 instances, their status, Regions, and tags. Also allows starting and stopping Amazon EC2 instances. + + * `tag` – Allows principals to retrieve tag information for Amazon EC2 instances to identify instances that should be managed by the automation. + + * `ssm` – Allows principals to check calendar states for Quick Setup change calendars, and to execute Systems Manager automation and associations for instance management. + + * `iam` – Allows principals to pass Quick Setup IAM roles to Systems Manager for automation execution, with specific conditions that restrict the service and resources that can use these roles. + + + + +To view more details about the policy, including the latest version of the JSON policy document, see [AWSQuickSetupStartStopInstancesExecutionPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSQuickSetupStartStopInstancesExecutionPolicy.html) in the _AWS Managed Policy Reference Guide_. + +## AWS managed policy: AWSQuickSetupStartSSMAssociationsExecutionPolicy + +This policy grants permissions that allow Quick Setup to run the `AWSQuickSetupType-StartSSMAssociations` Automation runbook. This runbook is used to start State Manager associations that are created by Quick Setup configurations. + +You can attach `AWSQuickSetupStartSSMAssociationsExecutionPolicy` to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf. + +**Permissions details** + +This policy includes the following permissions. + + * `ssm` – Allows principals to start automation executions specifically for the `AWSQuickSetupType-StartSSMAssociations` document. This is required for Quick Setup to run associations that configure managed instances. + + * `iam` – Allows principals to pass roles with names that begin with "AWS-QuickSetup-" to the Systems Manager service. This permission is restricted to use with specific SSM documents related to starting associations. This is required for Quick Setup to pass the appropriate execution role to the automation process. + + + + +To view more details about the policy, including the latest version of the JSON policy document, see [AWSQuickSetupStartSSMAssociationsExecutionPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSQuickSetupStartSSMAssociationsExecutionPolicy.html) in the _AWS Managed Policy Reference Guide_. + @@ -1289 +1333,3 @@ Change | Description | Date -AmazonSSMAutomationRole – Update to documentation | Systems Manager added comprehensive documentation for the existing `AmazonSSMAutomationRole` policy, which provides permissions for the Systems Manager Automation service to run activities defined within Automation runbooks. | July 15, 2025 +AWSQuickSetupStartSSMAssociationsExecutionPolicy – New policy | Systems Manager added a new policy to allow Quick Setup to run the `AWSQuickSetupType-StartSSMAssociations` Automation runbook. This runbook is used to start State Manager associations that are created by Quick Setup configurations. | August 12, 2025 +AWSQuickSetupStartStopInstancesExecutionPolicy – New policy | Systems Manager added a new policy to allow Quick Setup to start and stop Amazon EC2 instances on a schedule. This policy provides the necessary permissions for the Quick Setup scheduler configuration type to manage instance state based on defined schedules. | August 12, 2025 +AWSQuickSetupDeploymentRolePolicy – Update to documentation | Systems Manager has updated the `AWSQuickSetupDeploymentRolePolicy` managed policy to grant permissions for additional resources. In addition, the documentation for `AWSQuickSetupDeploymentRolePolicy` has been updated with more detailed descriptions of the permissions granted by this policy for Quick Setup configuration management operations. | July 30, 2025 @@ -1294,0 +1341 @@ AWSQuickSetupDeploymentRolePolicy – Update to a policy | Systems Manager adde +AmazonSSMAutomationRole – Update to documentation | Systems Manager added comprehensive documentation for the existing `AmazonSSMAutomationRole` policy, which provides permissions for the Systems Manager Automation service to run activities defined within Automation runbooks. | July 15, 2025