AWS systems-manager-automation-runbooks medium security documentation change

Service: systems-manager-automation-runbooks · 2025-08-28 · Security-related medium

File: systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-vpc-flowlogs.md

Summary

Removed sample IAM policy for VPC Flow Logs automation including permissions for SSM, EC2 Flow Logs, IAM role management, CloudWatch Logs, and S3 operations

Security assessment

Removal of explicit IAM policy guidance could lead to insecure permission configurations. VPC Flow Logs are a critical security monitoring feature, and improper IAM policies might expose sensitive logging data or allow privilege escalation

Diff

diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-vpc-flowlogs.md b/systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-vpc-flowlogs.md
index 018c67113..b2411e0a4 100644
--- a//systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-vpc-flowlogs.md
+++ b//systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-vpc-flowlogs.md
@@ -163,88 +162,0 @@ Sample Policy
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "SSMExecutionPermissions",
-                "Effect": "Allow",
-                "Action": [
-                    "ssm:StartAutomationExecution",
-                    "ssm:GetAutomationExecution"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Sid": "EC2FlowLogsPermissions",
-                "Effect": "Allow",
-                "Action": [
-                    "ec2:CreateFlowLogs",
-                    "ec2:DeleteFlowLogs",
-                    "ec2:DescribeFlowLogs"
-                ],
-                "Resource": "arn:aws:us-east-1:111122223333:{instance|subnet|vpc|transit-gateway|transit-gateway-attachment}/resource-id"
-            },
-            {
-                "Sid": "IAMCreateRolePermissions",
-                "Effect": "Allow",
-                "Action": [
-                    "iam:AttachRolePolicy",
-                    "iam:CreateRole",
-                    "iam:CreatePolicy",
-                    "iam:DeletePolicy",
-                    "iam:DeleteRole",
-                    "iam:DeleteRolePolicy",
-                    "iam:GetPolicy",
-                    "iam:GetRole",
-                    "iam:TagRole",
-                    "iam:PassRole",
-                    "iam:PutRolePolicy",
-                    "iam:UpdateRole"
-                ],
-                "Resource": [
-                    "arn:aws:us-east-1:111122223333:role/role-name",
-                    "arn:aws:us-east-1:111122223333:role/AWSSupportCreateFlowLogsRole"
-                ]
-            },
-            {
-                "Sid": "CloudWatchLogsPermissions",
-                "Effect": "Allow",
-                "Action": [
-                    "logs:CreateLogDelivery",
-                    "logs:CreateLogGroup",
-                    "logs:DeleteLogDelivery",
-                    "logs:DeleteLogGroup",
-                    "logs:DescribeLogGroups",
-                    "logs:DescribeLogStreams"
-                ],
-                "Resource": [
-                    "arn:aws:us-east-1:111122223333:log-group:log-group-name",
-                    "arn:aws:us-east-1:111122223333:log-group:log-group-name:*"
-                ]
-            },
-            {
-                "Sid": "S3Permissions",
-                "Effect": "Allow",
-                "Action": [
-                    "s3:GetBucketLocation",
-                    "s3:GetBucketPublicAccessBlock",
-                    "s3:GetAccountPublicAccessBlock",
-                    "s3:GetBucketPolicyStatus",
-                    "s3:GetBucketAcl",
-                    "s3:ListBucket",
-                    "s3:PutObject"
-                ],
-                "Resource": [
-                    "arn:aws:::",
-                    "arn:aws:::/*"
-                ]
-            }
-        ]
-    }
-    
-