AWS systems-manager high security documentation change
Summary
Added security warning about IAM bypass risk in AWS-RunDocument and mitigation strategies
Security assessment
Explicitly documents a security vulnerability where users can bypass document-specific IAM restrictions through parameter injection, with concrete evidence shown in the added warning text. The change provides mitigation strategies including allowlisting and permission boundaries.
Diff
diff --git a/systems-manager/latest/userguide/documents-running-remote-github-s3.md b/systems-manager/latest/userguide/documents-running-remote-github-s3.md index 6c63001af..e9a70c716 100644 --- a//systems-manager/latest/userguide/documents-running-remote-github-s3.md +++ b//systems-manager/latest/userguide/documents-running-remote-github-s3.md @@ -27,0 +28,17 @@ While you can also run remote documents by using State Manager or Automation, to +###### Warning + +`AWS-RunDocument` can execute document content from various sources (SSM documents, GitHub, S3, URLs). When executing remote documents, the IAM permissions evaluated are for `ssm:GetDocument` on the remote document and `ssm:SendCommand` on `AWS-RunDocument`. If you have IAM policies that deny access to specific SSM documents, users with `AWS-RunDocument` permissions can still execute those denied documents by passing the document content as parameters, which may not be subject to the same document-specific IAM restrictions. + +To properly restrict document execution, use one of these approaches: + + * **Allowlist approved sources** : If you need to use nested document execution, restrict access to only approved sources using appropriate controls for each source type: IAM policies to control `ssm:GetDocument` for SSM document sources, IAM and Amazon S3 bucket policies for Amazon S3 sources, and network settings (such as VPC endpoints or security groups) for public Internet sources. + + * **Restrict access to AWS-RunDocument** : Deny `ssm:SendCommand` on `AWS-RunDocument` and any other documents that use the `aws:runDocument` plugin in your IAM policies to prevent nested document execution. + + * **Use permission boundaries** : Implement IAM permission boundaries to set maximum permissions for users, preventing them from executing unauthorized documents regardless of the execution method. + + + + +For more information about IAM best practices and permission boundaries, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the _AWS Identity and Access Management User Guide_. +