AWS systems-manager-automation-runbooks medium security documentation change

Service: systems-manager-automation-runbooks · 2025-08-28 · Security-related medium

File: systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md

Summary

Removed sample IAM policy for IP monitoring automation containing permissions for IAM, CloudFormation, EC2, CloudWatch, and SSM operations

Security assessment

Deletion of detailed permission requirements for network monitoring automation removes guidance for least-privilege access. Missing these controls could lead to overprivileged roles being used for security monitoring tasks

Diff

diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md b/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md
index 5579462af..b5be493bf 100644
--- a//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md
+++ b//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md
@@ -118,84 +117,0 @@ It is recommended that the user who runs the automation have the **AmazonSSMAuto
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Action": [
-                    "iam:CreateRole",
-                    "iam:CreateInstanceProfile",
-                    "iam:GetRole",
-                    "iam:GetInstanceProfile",
-                    "iam:DetachRolePolicy",
-                    "iam:AttachRolePolicy",
-                    "iam:PassRole",
-                    "iam:AddRoleToInstanceProfile",
-                    "iam:GetRolePolicy",
-                    "iam:RemoveRoleFromInstanceProfile",
-                    "iam:DeleteRole",
-                    "iam:DeleteRolePolicy",
-                    "iam:DeleteInstanceProfile",
-                    "iam:PutRolePolicy",
-                    "iam:TagRole"
-                ],
-                "Resource": [
-                    "arn:aws::111122223333:role/SetupIPMonitoringFromVPC*",
-                    "arn:aws::111122223333:instance-profile/SetupIPMonitoringFromVPC*"
-                ],
-                "Effect": "Allow"
-            },
-            {
-                "Action": [
-                    "cloudformation:CreateStack",
-                    "cloudformation:CreateChangeSet",
-                    "cloudformation:DeleteStack",
-                    "cloudformation:DescribeStacks",
-                    "cloudformation:DescribeStackEvents",
-                    "cloudwatch:PutDashboard",
-                    "cloudwatch:DeleteDashboards",
-                    "ec2:AuthorizeSecurityGroupEgress",
-                    "ec2:CreateSecurityGroup",
-                    "ec2:CreateLaunchTemplate",
-                    "ec2:DeleteSecurityGroup",
-                    "ec2:DescribeImages",
-                    "ec2:DescribeSubnets",
-                    "ec2:DescribeInstanceTypes",
-                    "ec2:DescribeVpcs",
-                    "ec2:DeleteLaunchTemplate",
-                    "ec2:DeleteSecurityGroup",
-                    "ec2:RunInstances",
-                    "ec2:TerminateInstances",
-                    "ec2:DescribeInstanceStatus",
-                    "ec2:CreateTags",
-                    "ec2:AssignIpv6Addresses",
-                    "ec2:DescribeTags",
-                    "ec2:DescribeInstances",
-                    "ec2:DescribeSecurityGroups",
-                    "ec2:DescribeLaunchTemplates",
-                    "ec2:RevokeSecurityGroupEgress",
-                    "logs:CreateLogGroup",
-                    "logs:DeleteLogGroup",
-                    "logs:PutMetricFilter",
-                    "logs:PutRetentionPolicy",
-                    "logs:TagResource",
-                    "ssm:DescribeInstanceInformation",
-                    "ssm:GetParameter",
-                    "ssm:GetParameters",
-                    "ssm:SendCommand",
-                    "ssm:ListCommands",
-                    "ssm:ListCommandInvocations"
-                ],
-                "Resource": [
-                    "*"
-                ],
-                "Effect": "Allow"
-            }
-        ]
-    }
-    
-