AWS systems-manager medium security documentation change
Summary
Updated IAM policy documentation with refined permissions for EC2 instance management, SSM automation execution, and IAM role passing conditions
Security assessment
The changes enhance security by: 1) Adding explicit service principal restrictions (ssm.amazonaws.com) in IAM conditions 2) Narrowing EC2 instance control permissions from generic 'view detailed information' to specific 'describe' actions 3) Updating automation document references to focus on change calendar state management rather than broader associations 4) Introducing resource ARN restrictions in IAM role passing conditions. These changes implement least-privilege improvements and reduce potential attack surface.
Diff
diff --git a/systems-manager/latest/userguide/security-iam-awsmanpol.md b/systems-manager/latest/userguide/security-iam-awsmanpol.md index dfb573405..137ca8a54 100644 --- a//systems-manager/latest/userguide/security-iam-awsmanpol.md +++ b//systems-manager/latest/userguide/security-iam-awsmanpol.md @@ -754 +754 @@ This policy includes the following permissions. - * `ec2` – Allows principals to view detailed information about Amazon EC2 instances, their status, Regions, and tags. Also allows starting and stopping Amazon EC2 instances. + * `ec2` – Allows principals to describe Amazon EC2 instances, their status, regions, and tags. Also allows starting and stopping specific Amazon EC2 instances. @@ -756 +756 @@ This policy includes the following permissions. - * `tag` – Allows principals to retrieve tag information for Amazon EC2 instances to identify instances that should be managed by the automation. + * `ssm` – Allows principals to get calendar state from Quick Setup change calendars, start associations, and execute automation documents for instance scheduling. @@ -758,3 +758 @@ This policy includes the following permissions. - * `ssm` – Allows principals to check calendar states for Quick Setup change calendars, and to execute Systems Manager automation and associations for instance management. - - * `iam` – Allows principals to pass Quick Setup IAM roles to Systems Manager for automation execution, with specific conditions that restrict the service and resources that can use these roles. + * `iam` – Allows principals to pass Quick Setup IAM roles to Systems Manager for automation execution, with conditions that restrict the service to ssm.amazonaws.com and specific resource ARNs. @@ -769 +767 @@ To view more details about the policy, including the latest version of the JSON -This policy grants permissions that allow Quick Setup to run the `AWSQuickSetupType-StartSSMAssociations` Automation runbook. This runbook is used to start State Manager associations that are created by Quick Setup configurations. +This policy grants permissions that allow Quick Setup to run the `AWSQuickSetupType-Scheduler-ChangeCalendarState` Automation runbook. This runbook is used to manage change calendar states for scheduled operations in Quick Setup configurations. @@ -777 +775 @@ This policy includes the following permissions. - * `ssm` – Allows principals to start automation executions specifically for the `AWSQuickSetupType-StartSSMAssociations` document. This is required for Quick Setup to run associations that configure managed instances. + * `ssm` – Allows principals to start automation executions specifically for the `AWSQuickSetupType-Scheduler-ChangeCalendarState` document. This is required for Quick Setup to manage change calendar states for scheduled operations. @@ -779 +777 @@ This policy includes the following permissions. - * `iam` – Allows principals to pass roles with names that begin with "AWS-QuickSetup-" to the Systems Manager service. This permission is restricted to use with specific SSM documents related to starting associations. This is required for Quick Setup to pass the appropriate execution role to the automation process. + * `iam` – Allows principals to pass roles with names that begin with "AWS-QuickSetup-" to the Systems Manager service. This permission is restricted to use with specific SSM documents related to change calendar management. This is required for Quick Setup to pass the appropriate execution role to the automation process. @@ -1277,0 +1276,9 @@ AWSSystemsManagerJustInTimeAccessTokenPolicy – Update to an existing policy | +Updated managed policies: + + * AWSQuickSetupSSMLifecycleManagementExecutionPolicy + * AWSQuickSetupPatchPolicyPermissionsBoundary + * AWSQuickSetupManagedInstanceProfileExecutionPolicy + +| Systems Manager updated three managed policies to add support for starting Automation executions on additional Systems Manager resources, including specific Automation runbooks and SSM Command documents. | September 12, 2025 +AWSQuickSetupStartStopInstancesExecutionPolicy – Updated managed policy | Systems Manager updated the managed policy to refine permissions for Quick Setup scheduler configuration. The policy now provides more specific permissions for starting and stopping Amazon EC2 instances, accessing change calendars, and executing automation documents with enhanced security conditions. | September 12, 2025 +AWSQuickSetupStartSSMAssociationsExecutionPolicy – Updated managed policy | Systems Manager updated the managed policy to change the automation document from `AWSQuickSetupType-StartSSMAssociations` to `AWSQuickSetupType-Scheduler-ChangeCalendarState`. This update changes the policy's purpose from starting SSM associations to managing change calendar states for scheduled operations. | September 12, 2025