AWS systems-manager-automation-runbooks medium security documentation change

Service: systems-manager-automation-runbooks · 2025-10-25 · Security-related medium

File: systems-manager-automation-runbooks/latest/userguide/automation-troubleshoot-opensearch-high-cpu.md

Summary

Added documentation about IAM role requirements for Lambda invocation in Step Functions workflow, including example policy and parameter clarification

Security assessment

The change adds explicit IAM policy requirements for invoking Lambda functions, which directly relates to permissions management and least privilege security principles. The example policy shows how to restrict Lambda invocation to specific functions, improving security posture.

Diff

diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-troubleshoot-opensearch-high-cpu.md b/systems-manager-automation-runbooks/latest/userguide/automation-troubleshoot-opensearch-high-cpu.md
index 1d7f6e99a..0cfc9bafd 100644
--- a//systems-manager-automation-runbooks/latest/userguide/automation-troubleshoot-opensearch-high-cpu.md
+++ b//systems-manager-automation-runbooks/latest/userguide/automation-troubleshoot-opensearch-high-cpu.md
@@ -124,0 +125,4 @@ The `AutomationAssumeRole` parameter requires the following actions to use the r
+###### Note
+
+The `iam:CreateRole`, `iam:DeleteRole`, `iam:GetRole`, `iam:PutRolePolicy` `iam:PutRolePolicy`, and `iam:DeleteRolePolicy` are only required if you are not using an existing IAM role for **LambdaInvocationRoleForStepFunctions** parameter
+
@@ -147,0 +152,23 @@ The `ec2:DescribeNetworkInterfaces`, `ec2:CreateNetworkInterface`, and `ec2:Dele
+The `LambdaInvocationRoleForStepFunctions` parameter grants the permissions for AWS Step Functions state machine to invoke the Lambda function. The following is an example IAM policy that grants Step Functions permission to invoke the Lambda function that fetches diagnostic data from the OpenSearch Service domain. For more information, see [Creating a state machine IAM role ](https://docs.aws.amazon.com/step-functions/latest/dg/procedure-create-iam-role.html) in AWS Step Functions Developer Guide. 
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": "lambda:InvokeFunction",
+                "Resource": [
+                    "arn:aws:lambda:us-east-1:111122223333:function:AWSSupport-HighCPU-*"
+                ]
+            }
+        ]
+    }
+    
+
@@ -169,0 +197,4 @@ The ARN of the IAM role to attach to the Lambda function. The Lambda function us
+     * **LambdaInvocationRoleForStepFunctions (Optional):**
+
+(Optional) The ARN of the IAM role to attach to the Step Functions workflow. The state machine uses the credentials from this role to invoke the Lambda function that fetches diagnostic data from the OpenSearch Service domain. If no role is specified, this automation will create an IAM role for Step Functions in your account.
+
@@ -178,2 +208,0 @@ The number of data samples to collect from the Amazon OpenSearch Service domain.
-![Input parameters form for AWS Systems Manager Automation with fields for roles and settings.](/images/systems-manager-automation-runbooks/latest/userguide/images/awssupport-troubleshoot-opensearch-high-cpu_input_parameters.png)
-