AWS systems-manager documentation change
Summary
Added an entry for AmazonSSMAutomationRole policy update, adding cloudformation:TagResource and cloudformation:UntagResource permissions.
Security assessment
This documents an update to a managed IAM policy, adding permissions for tagging CloudFormation resources. It is security documentation but does not address a specific security issue; rather, it reflects an expansion of permissions for automation runbooks.
Diff
diff --git a/systems-manager/latest/userguide/security-iam-awsmanpol.md b/systems-manager/latest/userguide/security-iam-awsmanpol.md index 77e50f027..0f3b64336 100644 --- a//systems-manager/latest/userguide/security-iam-awsmanpol.md +++ b//systems-manager/latest/userguide/security-iam-awsmanpol.md @@ -1274,0 +1275 @@ Change | Description | Date +AmazonSSMAutomationRole – Update to an existing policy | Systems Manager added the `cloudformation:TagResource` and `cloudformation:UntagResource` permissions. These permissions allow Automation runbooks that create CloudFormation stacks to add and remove tags from resources. | March 20, 2026