AWS imagebuilder medium security documentation change
Summary
Updated IAM policy for service-linked role by removing `ssm:StartAutomationExecution` permission and documented lifecycle policy enhancements.
Security assessment
The removal of `ssm:StartAutomationExecution` from the service-linked role policy reduces unnecessary permissions, aligning with least privilege principles. This directly addresses potential over-permissioning security risks by revoking access no longer required after migration from SSM Automation.
Diff
diff --git a/imagebuilder/latest/userguide/doc-history.md b/imagebuilder/latest/userguide/doc-history.md index c65067f43..0893e7e48 100644 --- a//imagebuilder/latest/userguide/doc-history.md +++ b//imagebuilder/latest/userguide/doc-history.md @@ -15,0 +16,2 @@ Change| Description| Date +IAM policy update: service role policy| Removed `ssm:StartAutomationExecution` from the service-linked role policy, as the service completed its migration away from SSM Automation in 2023. For more information, see the [AWSServiceRoleForImageBuilder](https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-iam-awsmanpol.html#sec-iam-manpol-AWSServiceRoleForImageBuilder) policy.| February 26, 2026 +Feature release: Lifecycle policy enhancements| Lifecycle policy enhancements include streamlined role management with console-based role creation using service defaults, wildcard semantic version support for recipe-based policies (1.0.x, 1.x.x, x.x.x) to target multiple recipe versions with a single policy, tag-based resource collection for lifecycle policies, and console support for exclusion rules on both AMI and tag-based policies.| February 26, 2026