AWS incident-manager medium security documentation change

Service: incident-manager · 2025-11-22 · Security-related medium

File: incident-manager/latest/userguide/security-iam-awsmanpol.md

Summary

Simplified IAM policy documentation by removing JSON example and adding ssm-contacts permission for starting engagements. Updated policy change log.

Security assessment

Explicitly adds 'ssm-contacts' permission to start engagements during incidents, which modifies access control capabilities. This impacts security by expanding IAM policy permissions for incident response workflows. The change log entry confirms this is a security-relevant policy update.

Diff

diff --git a/incident-manager/latest/userguide/security-iam-awsmanpol.md b/incident-manager/latest/userguide/security-iam-awsmanpol.md
index 687140b94..c99bb0aa7 100644
--- a//incident-manager/latest/userguide/security-iam-awsmanpol.md
+++ b//incident-manager/latest/userguide/security-iam-awsmanpol.md
@@ -71,51 +71,5 @@ This policy includes the following permissions.
-  * `ssm-incidents` – Allows you to start incidents, list response plans, list incidents, update incidents, list timeline events, create custom timeline events, update custom timeline events, delete custom timeline events, list related items, create related items, and update related items.
-
-
-
-
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version":"2012-10-17",		 	 	 
-        "Statement": [
-            {
-                "Sid": "StartIncidentPermissions",
-                "Effect": "Allow",
-                "Action": [
-                    "ssm-incidents:StartIncident"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Sid": "ResponsePlanReadOnlyPermissions",
-                "Effect": "Allow",
-                "Action": [
-                    "ssm-incidents:ListResponsePlans",
-                    "ssm-incidents:GetResponsePlan"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Sid": "IncidentRecordResolverPermissions",
-                "Effect": "Allow",
-                "Action": [
-                    "ssm-incidents:ListIncidentRecords",
-                    "ssm-incidents:GetIncidentRecord",
-                    "ssm-incidents:UpdateIncidentRecord",
-                    "ssm-incidents:ListTimelineEvents",
-                    "ssm-incidents:CreateTimelineEvent",
-                    "ssm-incidents:GetTimelineEvent",
-                    "ssm-incidents:UpdateTimelineEvent",
-                    "ssm-incidents:DeleteTimelineEvent",
-                    "ssm-incidents:ListRelatedItems",
-                    "ssm-incidents:UpdateRelatedItems"
-                ],
-                "Resource": "*"
-            }
-        ]
-    }
+  * `ssm-incidents` – Allows principals to start incidents, list response plans, list incidents, update incidents, list timeline events, create custom timeline events, update custom timeline events, delete custom timeline events, list related items, create related items, and update related items.
+
+  * `ssm-contacts` – Allows principals to start engagements with contacts during incident creation.
+
+
@@ -131,0 +86 @@ Change | Description | Date
+AWSIncidentManagerResolverAccess – Policy update |  Incident Manager added permission to start engagements with contacts. | November 20, 2025