AWS systems-manager-automation-runbooks medium security documentation change
Summary
Added support for custom IAM instance profiles in the password reset runbook, including validation steps and updated IAM permission requirements. Introduced an optional InstanceProfileName parameter and expanded documentation about IAM role requirements.
Security assessment
The changes explicitly address IAM permission validation and security best practices for using custom instance profiles. The addition of iam:GetInstanceProfile and documentation about required permissions for custom profiles directly relates to preventing privilege escalation or unauthorized access if misconfigured. The runbook now enforces upfront validation of instance profile existence, reducing risks of runtime failures due to missing permissions.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-resetlinuxuserpassword.md b/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-resetlinuxuserpassword.md index 139cf476b..aac12470e 100644 --- a//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-resetlinuxuserpassword.md +++ b//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-resetlinuxuserpassword.md @@ -9 +9 @@ -The `AWSSupport-ResetLinuxUserPassword` runbook helps you reset the password of a local operating system (OS) user. This runbook is especially helpful for users who need to access their Amazon Elastic Compute Cloud (Amazon EC2) instances using the serial console. The runbook creates a temporary Amazon EC2 instance in your AWS account and an AWS Identity and Access Management (IAM) role with permissions to retrieve an AWS Secrets Manager secret value containing the password. +The `AWSSupport-ResetLinuxUserPassword` runbook helps you reset the password of a local operating system (OS) user. This runbook is especially helpful for users who need to access their Amazon Elastic Compute Cloud (Amazon EC2) instances using the serial console. The runbook creates a temporary Amazon EC2 instance in your AWS account with either an automatically generated AWS Identity and Access Management (IAM) role or a custom IAM instance profile you specify. The custom (IAM) instance profile must have permissions to retrieve the AWS Secrets Manager secret value containing the password. @@ -24,0 +25,2 @@ Create an Secrets Manager secret with the value of the password that you want to + * Using a custom IAM instance profile requires the `AutomationAssumeRole` to have IAM `GetInstanceProfile` permission for validation, and the custom instance profile itself must include Systems Manager and Secrets Manager access permissions. The runbook validates instance profile existence upfront but will fail during helper instance operations if the instance profile lacks required access. + @@ -101,0 +104,6 @@ Description: Enter `Yes` to acknowledge that your target Amazon EC2 instance wil + * InstanceProfileName + +Type: String + +Description: (Optional) The name of the IAM instance profile to attach to the helper Amazon EC2 instance. If not provided, a temporary instance profile with the required permissions will be created automatically. The custom instance profile must have permissions to access the specified Secrets Manager secret and Systems Manager. + @@ -172,0 +181,2 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r + * `iam:GetInstanceProfile` + @@ -200 +210,5 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 12. `aws:createStack` – Creates a temporary Amazon EC2 instance that is used to reset the password for the OS user that you specify. + 12. `aws:branch` – Branches the automation depending on whether a custom IAM instance profile name was provided or not + + 13. `aws:assertAwsResourceProperty` – Ensures the custom IAM instance profile exists and validates its name matches the input parameter. + + 14. `aws:createStack` – Creates a temporary Amazon EC2 instance that is used to reset the password for the OS user that you specify. @@ -202 +216 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 13. `aws:waitForAwsResourceProperty` – Waits until the newly launched temporary Amazon EC2 instance is running. + 15. `aws:waitForAwsResourceProperty` – Waits until the newly launched temporary Amazon EC2 instance is running. @@ -204 +218 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 14. `aws:executeAwsApi` – Gets the ID of the temporary Amazon EC2 instance. + 16. `aws:executeAwsApi` – Gets the ID of the temporary Amazon EC2 instance. @@ -206 +220 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 15. `aws:waitForAwsResourceProperty` – Waits for the temporary Amazon EC2 instance to report as managed by Systems Manager. + 17. `aws:waitForAwsResourceProperty` – Waits for the temporary Amazon EC2 instance to report as managed by Systems Manager. @@ -208 +222 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 16. `aws:changeInstanceState`– Stops the target Amazon EC2 instance. + 18. `aws:changeInstanceState`– Stops the target Amazon EC2 instance. @@ -210 +224 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 17. `aws:changeInstanceState` – Forces the target Amazon EC2 instance to stop in case it gets stuck in a stopping state. + 19. `aws:changeInstanceState` – Forces the target Amazon EC2 instance to stop in case it gets stuck in a stopping state. @@ -212 +226 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 18. `aws:branch` – Branches the automation depending on whether a snapshot of the root volume of the target Amazon EC2 instance was requested. + 20. `aws:branch` – Branches the automation depending on whether a snapshot of the root volume of the target Amazon EC2 instance was requested. @@ -214 +228 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 19. `aws:executeAwsApi` – Creates a snapshot of the target Amazon EC2 instance root Amazon EBS volume. + 21. `aws:executeAwsApi` – Creates a snapshot of the target Amazon EC2 instance root Amazon EBS volume. @@ -216 +230 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 20. `aws:waitForAwsResourceProperty` – Waits for the snapshot to be in a `completed` state. + 22. `aws:waitForAwsResourceProperty` – Waits for the snapshot to be in a `completed` state. @@ -218 +232 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 21. `aws:executeAwsApi` – Detaches the Amazon EBS root volume from the target Amazon EC2 instance. + 23. `aws:executeAwsApi` – Detaches the Amazon EBS root volume from the target Amazon EC2 instance. @@ -220 +234 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 22. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be detached from the target Amazon EC2 instance. + 24. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be detached from the target Amazon EC2 instance. @@ -222 +236 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 23. `aws:executeAwsApi` – Attaches the root Amazon EBS volume to the temporary Amazon EC2 instance. + 25. `aws:executeAwsApi` – Attaches the root Amazon EBS volume to the temporary Amazon EC2 instance. @@ -224 +238 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 24. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be attached to the temporary Amazon EC2 instance. + 26. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be attached to the temporary Amazon EC2 instance. @@ -226 +240 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 25. `aws:runCommand` – Resets the target user password by running a shell script using Run Command on the temporary Amazon EC2 instance. + 27. `aws:runCommand` – Resets the target user password by running a shell script using Run Command on the temporary Amazon EC2 instance. @@ -228 +242 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 26. `aws:executeAwsApi` – Detaches the Amazon EBS root volume from the temporary Amazon EC2 instance. + 28. `aws:executeAwsApi` – Detaches the Amazon EBS root volume from the temporary Amazon EC2 instance. @@ -230 +244 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 27. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be detached from the temporary Amazon EC2 instance. + 29. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be detached from the temporary Amazon EC2 instance. @@ -232 +246 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 28. `aws:executeAwsApi` – Detaches the Amazon EBS root volume from the temporary Amazon EC2 instance after an error. + 30. `aws:executeAwsApi` – Detaches the Amazon EBS root volume from the temporary Amazon EC2 instance after an error. @@ -234 +248 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 29. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be detached from the temporary Amazon EC2 instance after an error. + 31. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be detached from the temporary Amazon EC2 instance after an error. @@ -236 +250 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 30. `aws:branch` – Branches the automation depending on whether a snapshot of the root volume was requested to determine the recovery path in case of an error. + 32. `aws:branch` – Branches the automation depending on whether a snapshot of the root volume was requested to determine the recovery path in case of an error. @@ -238 +252 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 31. `aws:executeAwsApi` – Reattaches the root Amazon EBS volume to the target Amazon EC2 instance. + 33. `aws:executeAwsApi` – Reattaches the root Amazon EBS volume to the target Amazon EC2 instance. @@ -240 +254 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 32. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be attached to the Amazon EC2 instance. + 34. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS root volume to be attached to the Amazon EC2 instance. @@ -242 +256 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 33. `aws:executeAwsApi` – Creates a new Amazon EBS volume from the target Amazon EC2 instance root volume snapshot. + 35. `aws:executeAwsApi` – Creates a new Amazon EBS volume from the target Amazon EC2 instance root volume snapshot. @@ -244 +258 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 34. `aws:waitForAwsResourceProperty` – Waits until the new Amazon EBS volume is in an `available` state. + 36. `aws:waitForAwsResourceProperty` – Waits until the new Amazon EBS volume is in an `available` state. @@ -246 +260 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 35. `aws:executeAwsApi` – Attaches the new Amazon EBS volume to the target instance as the root volume. + 37. `aws:executeAwsApi` – Attaches the new Amazon EBS volume to the target instance as the root volume. @@ -248 +262 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 36. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS volume to be in an `attached` state. + 38. `aws:waitForAwsResourceProperty` – Waits for the Amazon EBS volume to be in an `attached` state. @@ -250 +264 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 37. `aws:executeAwsApi` – Describes the AWS CloudFormation stack events if the runbooks fails to create or update the AWS CloudFormation stack. + 39. `aws:executeAwsApi` – Describes the AWS CloudFormation stack events if the runbooks fails to create or update the AWS CloudFormation stack. @@ -252 +266 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 38. `aws:branch` – Branches the automation depending on the previous Amazon EC2 instance state. If the state was `running`, the instance is started. If it was in a `stopped` state, the automation continues. + 40. `aws:branch` – Branches the automation depending on the previous Amazon EC2 instance state. If the state was `running`, the instance is started. If it was in a `stopped` state, the automation continues. @@ -254 +268 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 39. `aws:changeInstanceState` – Starts the Amazon EC2 instance if needed. + 41. `aws:changeInstanceState` – Starts the Amazon EC2 instance if needed. @@ -256 +270 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 40. `aws:waitForAwsResourceProperty` – Waits until the AWS CloudFormation stack is in a terminal status before deleting. + 42. `aws:waitForAwsResourceProperty` – Waits until the AWS CloudFormation stack is in a terminal status before deleting. @@ -258 +272 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r - 41. `aws:executeAwsApi` – Deletes the AWS CloudFormation stack including the temporary Amazon EC2 instance. + 43. `aws:executeAwsApi` – Deletes the AWS CloudFormation stack including the temporary Amazon EC2 instance.