AWS systems-manager medium security documentation change

Service: systems-manager · 2025-08-28 · Security-related medium

File: systems-manager/latest/userguide/Explorer-exporting-OpsData.md

Summary

Removed a detailed IAM policy example for OpsData export automation service role

Security assessment

The removed IAM policy contained overly permissive resource definitions (e.g., 'arn:aws:s3:::/*' and wildcard permissions for logs). This change likely addresses security concerns by removing an example that could lead to excessive permissions if implemented. The removal of broad S3 bucket access and wildcard logging permissions reduces potential attack surface.

Diff

diff --git a/systems-manager/latest/userguide/Explorer-exporting-OpsData.md b/systems-manager/latest/userguide/Explorer-exporting-OpsData.md
index dccaf0609..c11bc4985 100644
--- a//systems-manager/latest/userguide/Explorer-exporting-OpsData.md
+++ b//systems-manager/latest/userguide/Explorer-exporting-OpsData.md
@@ -59,78 +58,0 @@ When you export Explorer data, Systems Manager creates an AWS Identity and Acces
-JSON
-    
-
-****
-    
-    
-    
-    {
-          "Version": "2012-10-17",
-          "Statement": [
-              {
-                  "Sid": "OpsSummaryExportAutomationServiceRoleStatement1",
-                  "Effect": "Allow",
-                  "Action": [
-                      "s3:PutObject"
-                  ],
-                  "Resource": [
-                     "arn:aws:s3:::/*"
-                  ]
-              },
-              {
-                  "Sid": "OpsSummaryExportAutomationServiceRoleStatement2",
-                  "Effect": "Allow",
-                  "Action": [
-                      "s3:GetBucketAcl",
-                      "s3:GetBucketLocation"
-                  ],
-                  "Resource": [
-                     "arn:aws:s3:::"
-                  ]
-              },
-              {
-                  "Sid": "OpsSummaryExportAutomationServiceRoleStatement3",
-                  "Effect": "Allow",
-                  "Action": [
-                      "sns:Publish"
-                  ],
-                  "Resource": [
-                      "arn:aws:sns:*:*:{{SNSTopicName}}"
-                  ]
-              },
-              {
-                  "Sid": "OpsSummaryExportAutomationServiceRoleStatement4",
-                  "Effect": "Allow",
-                  "Action": [
-                      "logs:DescribeLogGroups",
-                      "logs:DescribeLogStreams"
-                  ],
-                  "Resource": [
-                      "*"
-                  ]
-              },
-              {
-                  "Sid": "OpsSummaryExportAutomationServiceRoleStatement5",
-                  "Effect": "Allow",
-                  "Action": [
-                      "logs:CreateLogGroup",
-                      "logs:PutLogEvents",
-                      "logs:CreateLogStream"
-                  ],
-                  "Resource": [
-                      "*"
-                  ]
-              },
-              {
-                  "Sid": "OpsSummaryExportAutomationServiceRoleStatement6",
-                  "Effect": "Allow",
-                  "Action": [
-                      "ssm:GetOpsSummary"
-                  ],
-                  "Resource": [
-                      "*"
-                  ]
-              }
-          ]
-      }
-    
-