AWS systems-manager-automation-runbooks documentation change

Service: systems-manager-automation-runbooks · 2025-08-28 · Documentation low

File: systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshoot-ebs-csi-drivers-for-eks.md

Summary

Removed detailed IAM policy example for EBS CSI driver troubleshooting automation

Security assessment

The change removes a detailed IAM policy configuration but doesn't explicitly reference any security vulnerability or incident. While IAM policies relate to security, the removal itself doesn't indicate a security fix unless explicitly stated.

Diff

diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshoot-ebs-csi-drivers-for-eks.md b/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshoot-ebs-csi-drivers-for-eks.md
index 266f69915..45434e038 100644
--- a//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshoot-ebs-csi-drivers-for-eks.md
+++ b//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshoot-ebs-csi-drivers-for-eks.md
@@ -163,128 +162,0 @@ JSON
-JSON
-    
-
-****
-    
-    
-        {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "OptionalRestrictPutObjects",
-                "Effect": "Allow",
-                "Action": [
-                    "s3:PutObject"
-                ],
-                "Resource": [
-                    "arn:aws:::/*"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "ec2:DescribeIamInstanceProfileAssociations",
-                    "ec2:DescribeInstanceStatus",
-                    "ec2:GetEbsEncryptionByDefault",
-                    "eks:DescribeAddon",
-                    "eks:DescribeAddonVersions",
-                    "eks:DescribeCluster",
-                    "iam:GetInstanceProfile",
-                    "iam:GetOpenIDConnectProvider",
-                    "iam:GetRole",
-                    "iam:ListOpenIDConnectProviders",
-                    "iam:SimulatePrincipalPolicy",
-                    "s3:GetBucketLocation",
-                    "s3:GetBucketPolicyStatus",
-                    "s3:GetBucketPublicAccessBlock",
-                    "s3:GetBucketVersioning",
-                    "s3:ListBucket",
-                    "s3:ListBucketVersions",
-                    "ssm:DescribeInstanceInformation",
-                    "ssm:GetAutomationExecution",
-                    "ssm:GetDocument",
-                    "ssm:ListCommandInvocations",
-                    "ssm:ListCommands",
-                    "ssm:SendCommand",
-                    "ssm:StartAutomationExecution"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Sid": "SetupK8sApiProxyForEKSActions",
-                "Effect": "Allow",
-                "Action": [
-                    "cloudformation:CreateStack",
-                    "cloudformation:DeleteStack",
-                    "cloudformation:DescribeStacks",
-                    "cloudformation:UpdateStack",
-                    "ec2:CreateNetworkInterface",
-                    "ec2:DeleteNetworkInterface",
-                    "ec2:DescribeNetworkInterfaces",
-                    "ec2:DescribeRouteTables",
-                    "ec2:DescribeSecurityGroups",
-                    "ec2:DescribeSubnets",
-                    "ec2:DescribeVpcs",
-                    "eks:DescribeCluster",
-                    "iam:CreateRole",
-                    "iam:DeleteRole",
-                    "iam:GetRole",
-                    "iam:TagRole",
-                    "iam:UntagRole",
-                    "lambda:CreateFunction",
-                    "lambda:DeleteFunction",
-                    "lambda:GetFunction",
-                    "lambda:InvokeFunction",
-                    "lambda:ListTags",
-                    "lambda:TagResource",
-                    "lambda:UntagResource",
-                    "lambda:UpdateFunctionCode",
-                    "logs:CreateLogGroup",
-                    "logs:CreateLogStream",
-                    "logs:DescribeLogGroups",
-                    "logs:DescribeLogStreams",
-                    "logs:ListTagsForResource",
-                    "logs:PutLogEvents",
-                    "logs:PutRetentionPolicy",
-                    "logs:TagResource",
-                    "logs:UntagResource",
-                    "ssm:DescribeAutomationExecutions",
-                    "tag:GetResources",
-                    "tag:TagResources"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Sid": "PassRoleToAutomation",
-                "Effect": "Allow",
-                "Action": "iam:PassRole",
-                "Resource": [
-                    "arn:*:iam::*:role/TroubleshootEbsCsiDriversForEks-SSM-Role",
-                    "arn:*:iam::*:role/Automation-K8sProxy-Role-*"
-                ],
-                "Condition": {
-                    "StringLikeIfExists": {
-                        "iam:PassedToService": [
-                            "lambda.amazonaws.com",
-                            "ssm.amazonaws.com"
-                        ]
-                    }
-                }
-            },
-            {
-                "Sid": "AttachRolePolicy",
-                "Effect": "Allow",
-                "Action": [
-                    "iam:AttachRolePolicy",
-                    "iam:DetachRolePolicy"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringLikeIfExists": {
-                        "iam:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true"
-                    }
-                }
-            }
-        ]
-    }
-    
-