AWS systems-manager-automation-runbooks documentation change
Summary
Removed detailed IAM policy example specifying required permissions for AutomationAssumeRole
Security assessment
The removal of the IAM policy example may affect users' ability to configure proper permissions, but there's no evidence of a security vulnerability being addressed. The change could lead to misconfigurations if users rely on outdated examples, but no specific security issue is mentioned.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/awssupport-troubleshoot-s3-event-notifications.md b/systems-manager-automation-runbooks/latest/userguide/awssupport-troubleshoot-s3-event-notifications.md index fb37e5aa8..1df91922c 100644 --- a//systems-manager-automation-runbooks/latest/userguide/awssupport-troubleshoot-s3-event-notifications.md +++ b//systems-manager-automation-runbooks/latest/userguide/awssupport-troubleshoot-s3-event-notifications.md @@ -107,86 +106,0 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "S3Permission", - "Effect": "Allow", - "Action": [ - "s3:GetBucketLocation", - "s3:ListAllMyBuckets" - ], - "Resource": "*" - }, - { - "Sid": "S3PermissionGetBucketNotification", - "Effect": "Allow", - "Action": [ - "s3:GetBucketNotification" - ], - "Resource": "arn:aws:s3:::" - }, - { - "Sid": "SQSPermission", - "Effect": "Allow", - "Action": [ - "sqs:GetQueueAttributes", - "sqs:GetQueueUrl" - ], - "Resource": "arn:aws:sqs:us-east-1:111122223333:*" - }, - { - "Sid": "SNSPermission", - "Effect": "Allow", - "Action": [ - "sns:GetTopicAttributes" - ], - "Resource": "arn:aws:sns:us-east-1:111122223333:*" - }, - { - "Sid": "KMSPermission", - "Effect": "Allow", - "Action": [ - "kms:GetKeyPolicy", - "kms:DescribeKey", - "kms:ListAliases" - ], - "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-id" - }, - { - "Sid": "LambdaPermission", - "Effect": "Allow", - "Action": [ - "lambda:GetPolicy", - "lambda:GetFunction" - ], - "Resource": "arn:aws:lambda:us-east-1:111122223333:function:*" - }, - { - "Sid": "IAMPermission", - "Effect": "Allow", - "Action": [ - "iam:GetContextKeysForCustomPolicy", - "iam:SimulateCustomPolicy", - "iam:ListRoles" - ], - "Resource": "*" - }, - { - "Sid": "SSMPermission", - "Effect": "Allow", - "Action": [ - "ssm:DescribeAutomationStepExecutions" - ], - "Resource": "*" - } - ] - } - - -