AWS systems-manager documentation change
Summary
Added documentation for a new optional 'Association Dispatch Assume Role' parameter in State Manager associations, including UI instructions, CLI examples across platforms, and notes about phasing out service-linked roles in favor of custom IAM roles.
Security assessment
This change introduces documentation for a new IAM role parameter (AssociationDispatchAssumeRole) that allows users to specify a custom role for State Manager actions. The note explicitly recommends defining a custom IAM role for full control over permissions and mentions the phasing out of service-linked roles. This enhances security by promoting the principle of least privilege and explicit permission control, but there is no evidence it addresses a specific, disclosed security vulnerability.
Diff
diff --git a/systems-manager/latest/userguide/state-manager-associations-creating.md b/systems-manager/latest/userguide/state-manager-associations-creating.md index 6dfd4ea91..62b0345d9 100644 --- a//systems-manager/latest/userguide/state-manager-associations-creating.md +++ b//systems-manager/latest/userguide/state-manager-associations-creating.md @@ -101 +101,11 @@ State Manager doesn't support running associations that use a new version of a d - 7. (Optional) Choose a CloudWatch alarm to apply to your association for monitoring. + 7. (Optional) For **Association Dispatch Assume Role** , select a role from the drop-down. State Manager will take actions using this role on your behalf. For information about setting up the custom-provided role, see [Setup roles for AssociationDispatchAssumeRole](./state-manager-about.html#setup-assume-role) + +###### Note + +It is recommended that you define a custom IAM role so that you have full control of the permissions that State Manager has when taking actions on your behalf. + +Service-linked role support in State Manager is being phased out. Associations relying on service-linked role may require updates in the future to continue functioning properly. + +For information about managing the usage of custom-provided role, see [Manage usage of AssociationDispatchAssumeRole with ssm:AssociationDispatchAssumeRole](./state-manager-about.html#context-key-assume-role). + + 8. (Optional) Choose a CloudWatch alarm to apply to your association for monitoring. @@ -113 +123 @@ Note the following information about this step. - 8. For **Targets** , choose an option. For information about using targets, see [Understanding targets and rate controls in State Manager associations](./systems-manager-state-manager-targets-and-rate-controls.html). + 9. For **Targets** , choose an option. For information about using targets, see [Understanding targets and rate controls in State Manager associations](./systems-manager-state-manager-targets-and-rate-controls.html). @@ -119 +129 @@ In order for associations that are created with Automation runbooks to be applie - 9. In the **Specify schedule** section, choose either **On Schedule** or **No schedule**. If you choose **On Schedule** , use the buttons provided to create a cron or rate schedule for the association. + 10. In the **Specify schedule** section, choose either **On Schedule** or **No schedule**. If you choose **On Schedule** , use the buttons provided to create a cron or rate schedule for the association. @@ -123 +133 @@ If you don't want the association to run immediately after you create it, choose - 10. (Optional) In the **Schedule offset** field, specify a number between 1 and 6. + 11. (Optional) In the **Schedule offset** field, specify a number between 1 and 6. @@ -125 +135 @@ If you don't want the association to run immediately after you create it, choose - 11. In the **Advanced options** section use **Compliance severity** to choose a severity level for the association and use **Change Calendars** to choose a change calendar for the association. + 12. In the **Advanced options** section use **Compliance severity** to choose a severity level for the association and use **Change Calendars** to choose a change calendar for the association. @@ -131 +141 @@ The change calendar determines when the association runs. If the calendar is clo - 12. In the **Rate control** section, choose options to control how the association runs on multiple nodes. For more information about using rate controls, see [Understanding targets and rate controls in State Manager associations](./systems-manager-state-manager-targets-and-rate-controls.html). + 13. In the **Rate control** section, choose options to control how the association runs on multiple nodes. For more information about using rate controls, see [Understanding targets and rate controls in State Manager associations](./systems-manager-state-manager-targets-and-rate-controls.html). @@ -145 +155 @@ In the **Error threshold** section, choose an option: - 13. (Optional) For **Output options** , to save the command output to a file, select the **Enable writing output to S3** box. Enter the bucket and prefix (folder) names in the boxes. + 14. (Optional) For **Output options** , to save the command output to a file, select the **Enable writing output to S3** box. Enter the bucket and prefix (folder) names in the boxes. @@ -181 +191 @@ API operations that are initiated by the SSM document during an association run - 14. Choose **Create Association**. + 15. Choose **Create Association**. @@ -264,0 +275 @@ Linux & macOS + --association-dispatch-assume-role arn_of_role_to_be_used_when_dispatching_configurations \ @@ -285,0 +297 @@ Windows + --association-dispatch-assume-role arn_of_role_to_be_used_when_dispatching_configurations ^ @@ -306,0 +319 @@ PowerShell + -AssociationDispatchAssumeRole arn_of_role_to_be_used_when_dispatching_configurations ` @@ -327,0 +341 @@ Linux & macOS + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole \ @@ -339,0 +354 @@ Windows + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole ^ @@ -350,0 +366 @@ PowerShell + -AssociationDispatchAssumeRole "arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole" ` @@ -367,0 +384 @@ Linux & macOS + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole \ @@ -382,0 +400 @@ Windows + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole ^ @@ -397,0 +416 @@ PowerShell + -AssociationDispatchAssumeRole "arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole" ` @@ -418,0 +438 @@ Linux & macOS + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole \ @@ -431,0 +452 @@ Windows + -association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole ^ @@ -443,0 +465 @@ PowerShell + -AssociationDispatchAssumeRole "arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole" ` @@ -466,0 +489 @@ Linux & macOS + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole \ @@ -476,0 +500 @@ Windows + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole ^ @@ -489,0 +514 @@ PowerShell + -AssociationDispatchAssumeRole "arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole" ` @@ -505,0 +531 @@ Linux & macOS + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole \ @@ -515,0 +542 @@ Windows + --association-dispatch-assume-role arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole ^ @@ -524,0 +552 @@ PowerShell + -AssociationDispatchAssumeRole "arn:aws:iam::123456789012:role/myAssociationDispatchAssumeRole" `