AWS systems-manager high security documentation change
Summary
Removed entire example Automation document JSON configuration that demonstrated deploying domain controllers with insecure practices
Security assessment
The removed content contained security anti-patterns: 1) Hardcoded administrator password in plaintext ('sampleAdminPass123!') 2) Overly permissive security group allowing 0.0.0.0/0 ingress on all ports/protocols 3) Explicit credential handling in automation workflows. Removal suggests recognition of these security risks.
Diff
diff --git a/systems-manager/latest/userguide/automation-document-architecture-deployment-example.md b/systems-manager/latest/userguide/automation-document-architecture-deployment-example.md index 298b5fdc1..750f2b7e2 100644 --- a//systems-manager/latest/userguide/automation-document-architecture-deployment-example.md +++ b//systems-manager/latest/userguide/automation-document-architecture-deployment-example.md @@ -529,700 +528,0 @@ JSON - { - "description": "Custom Automation Deployment Example", - "schemaVersion": "0.3", - "assumeRole": "{{ AutomationAssumeRole }}", - "parameters": { - "AutomationAssumeRole": { - "type": "String", - "description": "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses your IAM permissions to run this runbook.", - "default": "" - } - }, - "mainSteps": [ - { - "name": "getLatestWindowsAmi", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "ssm", - "Api": "GetParameter", - "Name": "/aws/service/ami-windows-latest/Windows_Server-2016-English-Full-Base" - }, - "outputs": [ - { - "Name": "amiId", - "Selector": "$.Parameter.Value", - "Type": "String" - } - ], - "nextStep": "createSSMInstanceRole" - }, - { - "name": "createSSMInstanceRole", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "iam", - "Api": "CreateRole", - "AssumeRolePolicyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"ec2.amazonaws.com\"]},\"Action\":[\"sts:AssumeRole\"]}]}", - "RoleName": "sampleSSMInstanceRole" - }, - "nextStep": "attachManagedSSMPolicy" - }, - { - "name": "attachManagedSSMPolicy", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "iam", - "Api": "AttachRolePolicy", - "PolicyArn": "arn:aws:iam::aws:policy/service-role/AmazonSSMManagedInstanceCore", - "RoleName": "sampleSSMInstanceRole" - }, - "nextStep": "createSSMInstanceProfile" - }, - { - "name": "createSSMInstanceProfile", - "action":"aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "iam", - "Api": "CreateInstanceProfile", - "InstanceProfileName": "sampleSSMInstanceRole" - }, - "outputs": [ - { - "Name": "instanceProfileArn", - "Selector": "$.InstanceProfile.Arn", - "Type": "String" - } - ], - "nextStep": "addSSMInstanceRoleToProfile" - }, - { - "name": "addSSMInstanceRoleToProfile", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "iam", - "Api": "AddRoleToInstanceProfile", - "InstanceProfileName": "sampleSSMInstanceRole", - "RoleName": "sampleSSMInstanceRole" - }, - "nextStep": "createVpc" - }, - { - "name": "createVpc", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "ec2", - "Api": "CreateVpc", - "CidrBlock": "10.0.100.0/22" - }, - "outputs": [ - { - "Name": "vpcId", - "Selector": "$.Vpc.VpcId", - "Type": "String" - } - ], - "nextStep": "getMainRtb" - }, - { - "name": "getMainRtb", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "ec2", - "Api": "DescribeRouteTables", - "Filters": [ - { - "Name": "vpc-id", - "Values": ["{{ createVpc.vpcId }}"] - } - ] - }, - "outputs": [ - { - "Name": "mainRtbId", - "Selector": "$.RouteTables[0].RouteTableId", - "Type": "String" - } - ], - "nextStep": "verifyMainRtb" - }, - { - "name": "verifyMainRtb", - "action": "aws:assertAwsResourceProperty", - "onFailure": "Abort", - "inputs": { - "Service": "ec2", - "Api": "DescribeRouteTables", - "RouteTableIds": ["{{ getMainRtb.mainRtbId }}"], - "PropertySelector": "$.RouteTables[0].Associations[0].Main", - "DesiredValues": ["True"] - }, - "nextStep": "createPubSubnet" - }, - { - "name": "createPubSubnet", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "ec2", - "Api": "CreateSubnet", - "CidrBlock": "10.0.103.0/24", - "AvailabilityZone": "us-west-2c", - "VpcId": "{{ createVpc.vpcId }}" - }, - "outputs":[ - { - "Name": "pubSubnetId", - "Selector": "$.Subnet.SubnetId", - "Type": "String" - } - ], - "nextStep": "createPubRtb" - }, - { - "name": "createPubRtb", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "ec2", - "Api": "CreateRouteTable", - "VpcId": "{{ createVpc.vpcId }}" - }, - "outputs": [ - { - "Name": "pubRtbId", - "Selector": "$.RouteTable.RouteTableId", - "Type": "String" - } - ], - "nextStep": "createIgw" - }, - { - "name": "createIgw", - "action": "aws:executeAwsApi", - "onFailure": "Abort", - "inputs": { - "Service": "ec2", - "Api": "CreateInternetGateway" - }, - "outputs": [ - { - "Name": "igwId", - "Selector": "$.InternetGateway.InternetGatewayId", - "Type": "String" - } - ], - "nextStep": "attachIgw" - }, - { - "name": "attachIgw",