AWS cli medium security documentation change

Service: cli · 2026-02-22 · Security-related medium

File: cli/latest/reference/ssm/create-association-batch.md

Summary

Added --association-dispatch-assume-role parameter documentation

Security assessment

Introduces IAM role configuration for State Manager associations, phasing out service-linked roles. Explicit security guidance about permission control and deprecation warning for less secure default role. Directly impacts security posture by enabling least-privilege access.

Diff

diff --git a/cli/latest/reference/ssm/create-association-batch.md b/cli/latest/reference/ssm/create-association-batch.md
index cb8d5d8ed..a4d1b9bcc 100644
--- a//cli/latest/reference/ssm/create-association-batch.md
+++ b//cli/latest/reference/ssm/create-association-batch.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.25 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.27 Command Reference](../../index.html) »
@@ -72,0 +73 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20
+    [--association-dispatch-assume-role <value>]
@@ -843,0 +845,18 @@ JSON Syntax:
+`--association-dispatch-assume-role` (string)
+
+> A role used by association to take actions on your behalf. State Manager will assume this role and call required APIs when dispatching configurations to nodes. If not specified, [service-linked role for Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/using-service-linked-roles.html) will be used by default.
+> 
+> ### Note
+> 
+> It is recommended that you define a custom IAM role so that you have full control of the permissions that State Manager has when taking actions on your behalf.
+> 
+> Service-linked role support in State Manager is being phased out. Associations relying on service-linked role may require updates in the future to continue functioning properly.
+> 
+> Constraints:
+> 
+>   * min: `1`
+>   * max: `512`
+>   * pattern: `arn:aws(-[^:]+)?:iam::[0-9]{12}:role/.+`
+> 
+
+
@@ -1786,0 +1806,12 @@ Successful -> (list)
+>> 
+>> AssociationDispatchAssumeRole -> (string)
+>>
+>>> A role used by association to take actions on your behalf. State Manager will assume this role and call required APIs when dispatching configurations to nodes. If not specified, [service-linked role for Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/using-service-linked-roles.html) will be used by default.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `512`
+>>>   * pattern: `arn:aws(-[^:]+)?:iam::[0-9]{12}:role/.+`
+>>> 
+
@@ -2475 +2506 @@ Failed -> (list)
-  * [AWS CLI 2.33.25 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.27 Command Reference](../../index.html) »