AWS systems-manager documentation change
Summary
Updated formatting of IAM role names and clarified CloudFormation template selection steps for multi-account automation setup
Security assessment
Changes focus on formatting improvements and clearer template selection instructions without introducing or modifying security controls. No evidence of addressing vulnerabilities or security weaknesses.
Diff
diff --git a/systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md b/systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md index b682fe50b..ad66fb826 100644 --- a//systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md +++ b//systems-manager/latest/userguide/running-automations-multiple-accounts-regions.md @@ -68 +68 @@ When running automations across multiple Regions, accounts, or OUs, the automati -Use the following procedure to create the required IAM roles for Systems Manager Automation multi-Region and multi-account automation by using AWS CloudFormation. This procedure describes how to create the `**AWS-SystemsManager-AutomationAdministrationRole**` role. You only need to create this role in the Automation central account. This procedure also describes how to create the `**AWS-SystemsManager-AutomationExecutionRole**` role. You must create this role in _every_ account that you want to target to run multi-Region and multi-account automations. We recommend using AWS CloudFormation StackSets to create the `**AWS-SystemsManager-AutomationExecutionRole**` role in the accounts you want to target to run multi-Region and multi-account automations. +Use the following procedure to create the required IAM roles for Systems Manager Automation multi-Region and multi-account automation by using AWS CloudFormation. This procedure describes how to create the `AWS-SystemsManager-AutomationAdministrationRole` role. You only need to create this role in the Automation central account. This procedure also describes how to create the `AWS-SystemsManager-AutomationExecutionRole` role. You must create this role in _every_ account that you want to target to run multi-Region and multi-account automations. We recommend using AWS CloudFormation StackSets to create the `AWS-SystemsManager-AutomationExecutionRole` role in the accounts you want to target to run multi-Region and multi-account automations. @@ -72 +72,7 @@ Use the following procedure to create the required IAM roles for Systems Manager - 1. Download and unzip the [`AWS-SystemsManager-AutomationAdministrationRole.zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationAdministrationRole.zip). Or, if your accounts are managed by AWS Organizations [`AWS-SystemsManager-AutomationAdministrationRole (org).zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationAdministrationRole \(org\).zip). This file contains the `AWS-SystemsManager-AutomationAdministrationRole.yaml` AWS CloudFormation template file. + 1. Download and unzip the [`AWS-SystemsManager-AutomationAdministrationRole.zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationAdministrationRole.zip). + +-or- + +If your accounts are managed by AWS Organizations [`AWS-SystemsManager-AutomationAdministrationRole (org).zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationAdministrationRole \(org\).zip). + +These files contain the `AWS-SystemsManager-AutomationAdministrationRole.yaml` and `AWS-SystemsManager-AutomationAdministrationRole (org).yaml` AWS CloudFormation template files, respectively. @@ -80 +86 @@ Use the following procedure to create the required IAM roles for Systems Manager - 5. Choose **Choose file** , and then choose the `AWS-SystemsManager-AutomationAdministrationRole.yaml` AWS CloudFormation template file. + 5. Choose **Choose file** , and then choose the `AWS-SystemsManager-AutomationAdministrationRole.yaml` or `AWS-SystemsManager-AutomationAdministrationRole (org).yaml` AWS CloudFormation template file, depending on your selection in step 1. @@ -103 +109,7 @@ You must repeat the following procedure in _every_ account that you want to targ - 1. Download the [`AWS-SystemsManager-AutomationExecutionRole.zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationExecutionRole.zip). Or, if your accounts are managed by AWS Organizations [`AWS-SystemsManager-AutomationExecutionRole (org).zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationExecutionRole \(org\).zip). This file contains the `AWS-SystemsManager-AutomationExecutionRole.yaml` AWS CloudFormation template file. + 1. Download the [`AWS-SystemsManager-AutomationExecutionRole.zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationExecutionRole.zip). + +-or + +If your accounts are managed by AWS Organizations [`AWS-SystemsManager-AutomationExecutionRole (org).zip`](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/AWS-SystemsManager-AutomationExecutionRole \(org\).zip). + +These files contains the `AWS-SystemsManager-AutomationExecutionRole.yaml` and ``AWS-SystemsManager-AutomationExecutionRole (org).yaml``AWS CloudFormation template files, respectively. @@ -111 +123 @@ You must repeat the following procedure in _every_ account that you want to targ - 5. Choose **Choose file** , and then choose the `AWS-SystemsManager-AutomationExecutionRole.yaml` AWS CloudFormation template file. + 5. Choose **Choose file** , and then choose the `AWS-SystemsManager-AutomationExecutionRole.yaml` or `AWS-SystemsManager-AutomationExecutionRole (org).yaml` AWS CloudFormation template file, depending on your selection in step 1.