AWS systems-manager medium security documentation change
Summary
Expanded multi-account automation capabilities with OU hierarchy controls, exclusion lists, and presigned S3 URL support for target locations. Added examples and concurrency options.
Security assessment
Added ability to exclude specific accounts/OUs and use presigned URLs introduces security considerations. Exclusions help prevent unintended automation execution, while presigned URLs require proper access controls to prevent malicious target configuration. The change adds security documentation by explaining these access control mechanisms.
Diff
diff --git a/systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md b/systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md index 9e60b5e97..b682fe50b 100644 --- a//systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md +++ b//systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md @@ -5 +5 @@ -Setting up management account permissions for multi-Region and multi-account automationRun an automation in multiple Regions and accounts (console)Run an Automation in multiple Regions and accounts (command line) +Setting up management account permissions for multi-Region and multi-account automationRun an automation in multiple Regions and accounts (console)Run an automation in multiple Regions and accounts (command line) @@ -177 +177 @@ You can view information about a runbook by choosing the runbook name. - 7. In the **Target accounts and Regions** section, use the **Accounts and organizational (OUs)** field to specify the different AWS accounts or AWS organizational units (OUs) where you want to run the automation. Separate multiple accounts or OUs with a comma. + 7. In the **Target accounts and Regions** section, use the **Accounts, organizational units (OUs), and roots** field to specify the different AWS accounts or AWS organizational units (OUs) where you want to run the automation. Separate multiple accounts or OUs with a comma. @@ -179 +179,5 @@ You can view information about a runbook by choosing the runbook name. - 8. Use the **AWS Regions** list to choose one or more Regions where you want to run the automation. + 1. (Optional) Select the **Include child OUs** checkbox to include all child organizational units within the specified OUs. + + 2. (Optional) In the **Exclude accounts and organizational units (OUs)** field, enter a comma-separated list of account IDs and OU IDs that you want to exclude from the expanded entities entered above. + + 8. Use the **Regions** list to choose one or more Regions where you want to run the automation. @@ -236 +240,3 @@ In the **Concurrency** section, choose an option: -## Run an Automation in multiple Regions and accounts (command line) +After an automation execution completes, you can rerun the execution with the same or modified parameters. For more information, see [Rerunning automation executions](./automation-rerun-executions.html). + +## Run an automation in multiple Regions and accounts (command line) @@ -299 +305,3 @@ PowerShell -Here are several examples. +###### Examples: Running an automation in multiple Regions and accounts + +The following are examples demonstrating how to use the AWS CLI and PowerShell to run automations in multiple accounts and Regions with a single command. @@ -342,0 +351,4 @@ PowerShell +###### Note + +The `TargetLocationMaxConcurrency` option is available using the AWS CLI and AWS SDKs. + @@ -416 +428,46 @@ PowerShell -**Example 3** : This example restarts EC2 instances in the `123456789012` and `987654321098` accounts, which are located in the `us-east-2` and `us-west-1` Regions. The instances must be tagged with the tag key-pair value `Env-PROD`. +**Example 3** : This example demonstrates specifying multiple AWS accounts and Regions where the automation should run using the `--target-locations-url` option. The value for this option must be a JSON file in a publicly accessible [presigned Amazon S3 URL](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html). + +###### Note + +`--target-locations-url` is available when using the AWS CLI and AWS SDKs. + +Linux & macOS + + + aws ssm start-automation-execution \ + --document-name "MyCustomAutomationRunbook" \ + --target-locations-url "https://amzn-s3-demo-bucket.s3.amazonaws.com/target-locations.json" + +Windows + + + aws ssm start-automation-execution ^ + --document-name "MyCustomAutomationRunbook" ^ + --target-locations-url "https://amzn-s3-demo-bucket.s3.amazonaws.com/target-locations.json" + +PowerShell + + + Start-SSMAutomationExecution ` + -DocumentName "MyCustomAutomationRunbook" ` + -TargetLocationsUrl "https://amzn-s3-demo-bucket.s3.amazonaws.com/target-locations.json" + + +Sample content for the JSON file: + + [ + { + "Accounts": [ "123456789012", "987654321098", "456789123012" ], + "ExcludeAccounts": [ "111222333444", "999888444666" ], + "ExecutionRoleName": "MyAutomationExecutionRole", + "IncludeChildOrganizationUnits": true, + "Regions": [ "us-east-1", "us-west-2", "ap-south-1", "ap-northeast-1" ], + "Targets": ["Key": "AWS::EC2::Instance", "Values": ["i-2"]], + "TargetLocationMaxConcurrency": "50%", + "TargetLocationMaxErrors": "10", + "TargetsMaxConcurrency": "20", + "TargetsMaxErrors": "12" + } + ] + +**Example 4** : This example restarts EC2 instances in the `123456789012` and `987654321098` accounts, which are located in the `us-east-2` and `us-west-1` Regions. The instances must be tagged with the tag key-pair value `Env-PROD`. @@ -456 +513 @@ PowerShell -**Example 4** : This example restarts EC2 instances in the `123456789012` and `987654321098` accounts, which are located in the `eu-central-1` Region. The instances must be members of the `prod-instances` AWS resource group. +**Example 5** : This example restarts EC2 instances in the `123456789012` and `987654321098` accounts, which are located in the `eu-central-1` Region. The instances must be members of the `prod-instances` AWS resource group. @@ -496 +553 @@ PowerShell -**Example 5** : This example restarts EC2 instances in the `ou-1a2b3c-4d5e6c` AWS organizational unit (OU). The instances are located in the `us-west-1` and `us-west-2` Regions. The instances must be members of the `WebServices` AWS resource group. +**Example 6** : This example restarts EC2 instances in the `ou-1a2b3c-4d5e6c` AWS organizational unit (OU). The instances are located in the `us-west-1` and `us-west-2` Regions. The instances must be members of the `WebServices` AWS resource group.