AWS systems-manager documentation change
Summary
Updated example ARNs to use us-east-1 region and consistent account ID 111122223333. Added note formatting for KMS permission requirement.
Security assessment
Changes involve standard documentation example updates (region/account IDs) and formatting adjustments. No security vulnerabilities addressed or new security features documented.
Diff
diff --git a/systems-manager/latest/userguide/sysman-paramstore-access.md b/systems-manager/latest/userguide/sysman-paramstore-access.md index 4b01f09b9..2c1b46eda 100644 --- a//systems-manager/latest/userguide/sysman-paramstore-access.md +++ b//systems-manager/latest/userguide/sysman-paramstore-access.md @@ -54 +54 @@ JSON - "Resource": "arn:aws:ssm:us-east-2:123456789012:parameter/prod-*" + "Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/prod-*" @@ -88 +88 @@ JSON - "Resource": "arn:aws:ssm:us-east-2:111122223333:parameter/dbserver-prod-*" + "Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/dbserver-prod-*" @@ -124 +124 @@ JSON - "Resource": "arn:aws:ssm:us-east-2:123456789012:parameter/prod-*" + "Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/prod-*" @@ -160 +160 @@ JSON - "Resource": "arn:aws:ssm:us-east-2:111122223333:parameter/prod-*" + "Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/prod-*" @@ -203 +203 @@ JSON - "arn:aws:ssm:us-east-2:111122223333:parameter/prod-*" + "arn:aws:ssm:us-east-1:111122223333:parameter/prod-*" @@ -212 +212 @@ JSON - "arn:aws:kms:us-east-2:111122223333:key/4914ec06-e888-4ea5-a371-5b88eEXAMPLE" + "arn:aws:kms:us-east-1:111122223333:key/4914ec06-e888-4ea5-a371-5b88eEXAMPLE" @@ -243 +243 @@ JSON - "arn:aws:ssm:us-east-2:111122223333:parameter/prod-*" + "arn:aws:ssm:us-east-1:111122223333:parameter/prod-*" @@ -254 +254 @@ JSON - "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-12345EXAMPLE" + "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-12345EXAMPLE" @@ -261 +261,3 @@ JSON -**1** The `kms:GenerateDataKey` permission is required for creating encrypted advanced parameters using the specified customer managed key. +###### Note + +The `kms:GenerateDataKey` permission is required for creating encrypted advanced parameters using the specified customer managed key. @@ -267 +269 @@ By contrast, all users within the customer account have access to the default AW -You can locate the Amazon Resource Name (ARN) of the default key in the AWS KMS console on the [AWS managed keys](https://console.aws.amazon.com/kms/home#/kms/defaultKeys) page. The default key is the one identified with `aws/ssm` in the **Alias** column. +You can locate the Amazon Resource Name (ARN) of the default key in the AWS KMS console on the [AWS managed keys](https://console.aws.amazon.com/kms/home#/kms/defaultKeys) page. The default key is identified with `aws/ssm` in the **Alias** column. @@ -286 +288 @@ JSON - "arn:aws:kms:us-east-2:111122223333:key/abcd1234-ab12-cd34-ef56-abcdeEXAMPLE" + "arn:aws:kms:us-east-1:111122223333:key/abcd1234-ab12-cd34-ef56-abcdeEXAMPLE"