AWS systems-manager-automation-runbooks medium security documentation change
Summary
Changed multiple parameters from required to optional with added defaults: AMI ID, instance type, key pair, security group rules, and tags. Added warnings about Windows key support and security group behavior.
Security assessment
Default RDP CIDR set to 0.0.0.0/0 creates insecure exposure risk. Explicit note about Windows ED25519 key incompatibility prevents misconfiguration. Security group note warns about rule persistence risks.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-create-ds-management-instance.md b/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-create-ds-management-instance.md index c7ebdc122..4f90481c0 100644 --- a//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-create-ds-management-instance.md +++ b//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-create-ds-management-instance.md @@ -39 +39 @@ Default: `{{ ssm:/aws/service/ami-windows-latest/Windows_Server-2019-English-Ful -Description: (Required) The ID of the Amazon Machine Image (AMI) you want to use to launch the management instance. +Description: (Optional) Amazon Machine Image (AMI) id to use for launching the instance. By Default the instance will launch with the latest Microsoft Windows Server 2019 Base AMI. @@ -45 +45 @@ Type: String -Description: (Required) The ID of the Directory Service directory you want to manage. The instance is joined to the directory you specify. +Description: (Required) The Directory Id of your Directory Service directory. @@ -51 +51,3 @@ Type: String -Description: (Required) The name you specify is applied to the IAM instance profile that is created by the automation and attached to the management instance. +Description: (Optional) IAM instance profile name. By Default, if no instance profile exists with the name AmazonSSMDirectoryServiceInstanceProfileRole, an instance profile with the name AmazonSSMDirectoryServiceInstanceProfileRole will be created. + +Default: AmazonSSMDirectoryServiceInstanceProfileRole @@ -89 +91 @@ Allowed values: -Description: (Required) The type of instance you want to launch. +Description: (Optional) Type of instance to launch. Default is t3.medium. @@ -95 +97,3 @@ Type: String -Description: (Optional) The key pair to use when creating the instance. If you do not specify a value, no key pair is associated with the instance. +Description: (Optional) Key pair to use when launching instance. Windows does not support ED25519 key pairs. By Default the instance is launched without a key pair (NoKeyPair). + +Default: NoKeyPair @@ -101 +105,3 @@ Type: String -Description: (Required) The CIDR block you want to allow RDP traffic (port 3389) from. The CIDR block you specify is applied to an inbound rule that's added to the security group created by the automation. +Description: (Optional) Creates Security group with port for RDP (Port range 3389) open to IPs specified by CIDR (default is 0.0.0.0/0). If the security group already exists it will not be modified and rules will not be changed. + +Default: 0.0.0.0/0 @@ -107 +113,3 @@ Type: String -Description: (Required) The name you specify is applied to the security group that is created by the automation and associated with the management instance. +Description: (Optional) Security group name. By Default, if no security group exists with the name AmazonSSMDirectoryServiceSecurityGroup, a security group with the name AmazonSSMDirectoryServiceSecurityGroup will be created. + +Default: AmazonSSMDirectoryServiceSecurityGroup @@ -114,0 +123,2 @@ Description: (Optional) A key-value pair you want to apply to the resources crea +Default: ` [ {"Key":"Description","Value":"Created by AWS Systems Manager Automation"}, {"Key":"Created By","Value":"AWS Systems Manager Automation"} ]` +