AWS AWSCloudFormation medium security documentation change
Summary
Updated Windows template to use SSM parameter for AMI, removed region mappings, simplified IAM permissions (removed s3:GetObject), and modernized agent installation process.
Security assessment
Eliminated s3:GetObject permission that was previously granted for agent setup, reducing potential privilege escalation risks. IAM policy now uses specific logs permissions rather than wildcard Create* actions, adhering to least privilege principles.