AWS imagebuilder medium security documentation change
Summary
Documented removal of `ssm:StartAutomationExecution` permission from AWSServiceRoleForImageBuilder policy.
Security assessment
Explicit removal of unnecessary SSM Automation permissions from the service role policy constitutes a security hardening measure to reduce attack surface and enforce least privilege.
Diff
diff --git a/imagebuilder/latest/userguide/security-iam-awsmanpol.md b/imagebuilder/latest/userguide/security-iam-awsmanpol.md index 0f8fb9a29..28e27eb57 100644 --- a//imagebuilder/latest/userguide/security-iam-awsmanpol.md +++ b//imagebuilder/latest/userguide/security-iam-awsmanpol.md @@ -215,0 +216,5 @@ Change | Description | Date +AWSServiceRoleForImageBuilder – Update to an existing policy | Image Builder made the following changes to the service role: + + * Removed `ssm:StartAutomationExecution`, as the service completed its migration away from SSM Automation in 2023 and no longer requires this permission. + +| February 26, 2026