AWS cli medium security documentation change

Service: cli · 2026-02-22 · Security-related medium

File: cli/latest/reference/ssm/create-association.md

Summary

Added --association-dispatch-assume-role parameter documentation

Security assessment

Documents new IAM role option for associations, replacing service-linked roles. Security note emphasizes permission control and warns about future incompatibility of default role. Addresses security through explicit permission management.

Diff

diff --git a/cli/latest/reference/ssm/create-association.md b/cli/latest/reference/ssm/create-association.md
index e0e070aae..f62e2b136 100644
--- a//cli/latest/reference/ssm/create-association.md
+++ b//cli/latest/reference/ssm/create-association.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.25 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.27 Command Reference](../../index.html) »
@@ -88,0 +89 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20
+    [--association-dispatch-assume-role <value>]
@@ -955,0 +957,18 @@ JSON Syntax:
+`--association-dispatch-assume-role` (string)
+
+> A role used by association to take actions on your behalf. State Manager will assume this role and call required APIs when dispatching configurations to nodes. If not specified, [service-linked role for Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/using-service-linked-roles.html) will be used by default.
+> 
+> ### Note
+> 
+> It is recommended that you define a custom IAM role so that you have full control of the permissions that State Manager has when taking actions on your behalf.
+> 
+> Service-linked role support in State Manager is being phased out. Associations relying on service-linked role may require updates in the future to continue functioning properly.
+> 
+> Constraints:
+> 
+>   * min: `1`
+>   * max: `512`
+>   * pattern: `arn:aws(-[^:]+)?:iam::[0-9]{12}:role/.+`
+> 
+
+
@@ -1956,0 +1976,12 @@ AssociationDescription -> (structure)
+> 
+> AssociationDispatchAssumeRole -> (string)
+>
+>> A role used by association to take actions on your behalf. State Manager will assume this role and call required APIs when dispatching configurations to nodes. If not specified, [service-linked role for Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/using-service-linked-roles.html) will be used by default.
+>> 
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `512`
+>>   * pattern: `arn:aws(-[^:]+)?:iam::[0-9]{12}:role/.+`
+>> 
+
@@ -1968 +1999 @@ AssociationDescription -> (structure)
-  * [AWS CLI 2.33.25 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.27 Command Reference](../../index.html) »