AWS systems-manager-automation-runbooks documentation change

Service: systems-manager-automation-runbooks · 2025-08-28 · Documentation low

File: systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md

Summary

Removed IAM policy example required for enabling Windows EC2 serial console automation

Security assessment

The deletion of an IAM policy example doesn't directly indicate a security fix. While IAM policies control access, there's no evidence this change addresses a specific vulnerability or weakness in the documentation.

Diff

diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md b/systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md
index eda782c1e..3f18abff0 100644
--- a//systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md
+++ b//systems-manager-automation-runbooks/latest/userguide/automation-enable-windows-ec2-serial-console.md
@@ -50,124 +49,0 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "autoscaling:DescribeAutoScalingInstances",
-                    "ec2:GetSerialConsoleAccessStatus",
-                    "ec2:Describe*",
-                    "ec2:createTags",
-                    "ec2:createImage",
-                    "ssm:DescribeAutomationExecutions",
-                    "ssm:DescribeInstanceInformation",
-                    "ssm:GetAutomationExecution",
-                    "ssm:ListCommandInvocations",
-                    "ssm:ListCommands"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "ec2:AttachVolume",
-                    "ec2:DetachVolume",
-                    "ec2:ModifyInstanceAttribute",
-                    "ec2:RebootInstances",
-                    "ec2:StartInstances",
-                    "ec2:StopInstances",
-                    "iam:GetInstanceProfile",
-                    "ssm:GetParameters",
-                    "ssm:SendCommand",
-                    "ssm:StartAutomationExecution"
-                ],
-                "Resource": [
-                    "arn:aws:us-east-1:111122223333:instance/i-02573cafcfEXAMPLE",
-                    "arn:aws:us-east-1:111122223333:volume/vol-049df61146EXAMPLE",
-                    "arn:aws:us-east-1:111122223333:instance-profile/instance-profile-name",
-                    "arn:aws:us-east-1:111122223333:parameter/aws/service/*",
-                    "arn:aws:us-east-1:111122223333:automation-definition/AWSSupport-StartEC2RescueWorkflow:*",
-                    "arn:aws:us-east-1:111122223333:document/AWS-ConfigureAWSPackage",
-                    "arn:aws:us-east-1:111122223333:document/AWS-RunPowerShellScript"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "cloudformation:CreateStack"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringLike": {
-                        "aws:RequestTag/Name": "AWSSupport-EC2Rescue: *"
-                    },
-                    "ForAllValues:StringEquals": {
-                        "aws:TagKeys": [
-                            "AWSSupport-EC2Rescue-AutomationExecution",
-                            "Name"
-                        ]
-                    }
-                }
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "cloudformation:DeleteStack",
-                    "cloudformation:DescribeStackEvents",
-                    "cloudformation:DescribeStackResource",
-                    "cloudformation:DescribeStacks",
-                    "ec2:AttachVolume",
-                    "ec2:DetachVolume",
-                    "ec2:RebootInstances",
-                    "ec2:StopInstances",
-                    "ec2:TerminateInstances",
-                    "ssm:SendCommand"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringLike": {
-                        "aws:ResourceTag/Name": "AWSSupport-EC2Rescue: *"
-                    }
-                }
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "ec2:CreateLaunchTemplate",
-                    "ec2:DeleteLaunchTemplate",
-                    "ec2:RunInstances"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "ForAnyValue:StringEquals": {
-                        "aws:CalledVia": [
-                            "cloudformation.amazonaws.com"
-                        ]
-                    }
-                }
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "iam:PassRole"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringLikeIfExists": {
-                        "iam:PassedToService": [
-                            "ssm.amazonaws.com",
-                            "ec2.amazonaws.com"
-                        ]
-                    }
-                }
-            }
-        ]
-    }
-    
-