AWS systems-manager documentation change
Summary
Added Patch Manager IPv6 support, announced Change Manager availability changes, updated managed policies with refined permissions and automation document changes, and corrected typographical errors.
Security assessment
The addition of IPv6 support includes references to improving security with VPC endpoints. Updates to managed policies mention enhanced security conditions and refined permissions, which are security best practices but do not address specific vulnerabilities.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-release-history.md b/systems-manager/latest/userguide/systems-manager-release-history.md index b65fd882b..8687d7201 100644 --- a//systems-manager/latest/userguide/systems-manager-release-history.md +++ b//systems-manager/latest/userguide/systems-manager-release-history.md @@ -12,0 +13,2 @@ Change| Description| Date +Patch Manager support for IPv6 environments| Patch Manager now provides support for Internet Protocol version 6 (IPv6) environments. For information, see [Improve the security of EC2 instances by using VPC endpoints for Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html) and [Patching a server in an IPv6 only environment](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-server-patching-iPv6-tutorial.html).| October 15, 2025 +AWS Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025.| AWS Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [AWS Systems Manager Change Manager availability change](https://docs.aws.amazon.com/systems-manager/latest/userguide/change-manager-availability-change.html). | October 7, 2025 @@ -14,0 +17,3 @@ Updated managed policy AWSSystemsManagerJustInTimeAccessTokenPolicy| Systems Man +Updated managed policy: AWSQuickSetupStartStopInstancesExecutionPolicy| Systems Manager has updated the managed policy `AWSQuickSetupStartStopInstancesExecutionPolicy` to refine permissions for Quick Setup scheduler configuration. The policy now provides more specific permissions for starting and stopping Amazon EC2 instances, accessing change calendars, and executing automation documents with enhanced security conditions. For information, see [Systems Manager updates to AWS managed policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| September 12, 2025 +Updated managed policy: AWSQuickSetupStartSSMAssociationsExecutionPolicy| Systems Manager has updated the managed policy `AWSQuickSetupStartSSMAssociationsExecutionPolicy` to change the automation document from `AWSQuickSetupType-StartSSMAssociations` to `AWSQuickSetupType-Scheduler-ChangeCalendarState`. This update changes the policy's purpose from starting SSM associations to managing change calendar states for scheduled operations. For information, see [Systems Manager updates to AWS managed policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| September 12, 2025 +Three updated managed policies| Systems Manager has updated three managed policies to enable Quick Setup to start Automation executions on additional Systems Manager resources: `AWSQuickSetupSSMLifecycleManagementExecutionPolicy`, `AWSQuickSetupPatchPolicyPermissionsBoundary`, and `AWSQuickSetupManagedInstanceProfileExecutionPolicy`. For information, see [Systems Manager updates to AWS managed policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| September 12, 2025 @@ -470 +475 @@ Automation Runbook Reference reorganization| To help you find the runbooks you n -Patch Manager: Generate .csv patch compliance reports| Patch Manager now supports the ability to generate patch compliance reports for your instances and save the report in an S3 bucket of your choice, in .csv format. Then, using a tool like [Amazon QuickSight](https://docs.aws.amazon.com/quicksuite/latest/userguide/what-is.html), you can analyze the patch compliance report data. You can generate a patch compliance report for a single instance, or for all instances in your AWS account. You can generate a one-time report on demand, or set up a schedule for reports to be created automatically. You can also specify an Amazon Simple Notification Service topic to provide notifications when a report is generated. For more information, see [Generating CSV patch compliance reports](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-store-compliance-results-in-s3.html).| April 9, 2021 +Patch Manager: Generate .csv patch compliance reports| Patch Manager now supports the ability to generate patch compliance reports for your instances and save the report in an S3 bucket of your choice, in .csv format. Then, using a tool like [Amazon Quick Suite](https://docs.aws.amazon.com/quicksuite/latest/userguide/what-is.html), you can analyze the patch compliance report data. You can generate a patch compliance report for a single instance, or for all instances in your AWS account. You can generate a one-time report on demand, or set up a schedule for reports to be created automatically. You can also specify an Amazon Simple Notification Service topic to provide notifications when a report is generated. For more information, see [Generating CSV patch compliance reports](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-store-compliance-results-in-s3.html).| April 9, 2021 @@ -971 +976 @@ For more information, see [AWS Systems Manager Patch Manager](./patch-manager.ht -Resource data sync | You can use Systems Manager resource data sync to send Inventory data collected from all of your managed instances to a single Amazon S3 bucket. Resource data sync then automatically updates the centralized data when new Inventory data is collected. With all Inventory data stored in a target S3 bucket, you can use services like Amazon Athena and Amazon QuickSight to query and analyze the aggregated data.For more information, see [Creating a resource data sync for Inventory](./inventory-create-resource-data-sync.html). For an example of how to work with resource data sync, see [Walkthrough: Using resource data sync to aggregate inventory data](./inventory-resource-data-sync.html). | June 29, 2017 +Resource data sync | You can use Systems Manager resource data sync to send Inventory data collected from all of your managed instances to a single Amazon S3 bucket. Resource data sync then automatically updates the centralized data when new Inventory data is collected. With all Inventory data stored in a target S3 bucket, you can use services like Amazon Athena and Amazon Quick Suite to query and analyze the aggregated data.For more information, see [Creating a resource data sync for Inventory](./inventory-create-resource-data-sync.html). For an example of how to work with resource data sync, see [Walkthrough: Using resource data sync to aggregate inventory data](./inventory-resource-data-sync.html). | June 29, 2017