AWS sql-server-ec2 documentation change

Service: sql-server-ec2 · 2026-04-04 · Documentation low

File: sql-server-ec2/latest/userguide/security-iam-awsmanpol.md

Summary

Added documentation for new AWS managed policy AWSEC2VssRestorePolicy used for SQL Server database restoration from VSS snapshots

Security assessment

This change documents a new IAM policy for database restoration operations, which is a security feature (access control). The policy grants specific permissions for volume creation, attachment, and SSM command execution during restoration. No evidence of addressing a specific security vulnerability.

Diff

diff --git a/sql-server-ec2/latest/userguide/security-iam-awsmanpol.md b/sql-server-ec2/latest/userguide/security-iam-awsmanpol.md
index 09aee57cc..3fb6d9e34 100644
--- a//sql-server-ec2/latest/userguide/security-iam-awsmanpol.md
+++ b//sql-server-ec2/latest/userguide/security-iam-awsmanpol.md
@@ -5 +5 @@
-AWSEC2SqlHaInstancePolicyAWSEC2SqlHaServiceRolePolicyPolicy updates
+AWSEC2SqlHaInstancePolicyAWSEC2SqlHaServiceRolePolicyAWSEC2VssRestorePolicyPolicy updates
@@ -26,0 +27,17 @@ To view the permissions for this policy, see [AWSEC2SqlHaServiceRolePolicy](http
+## AWS managed policy: AWSEC2VssRestorePolicy
+
+You can attach this managed policy to the IAM role that's used to execute the `AWSEC2-RestoreSqlServerDatabaseWithVss` automation runbook. The policy grants permissions to create volumes from VSS snapshots, attach them to instances, and invoke AWS Systems Manager Run Command documents required for database restoration.
+
+###### Permissions details
+
+This policy includes the following permissions:
+
+  * **ec2** – Allows principals to create volumes from snapshots tagged with `AwsVssConfig`, attach volumes to instances, tag volumes during creation, and describe volumes, snapshots, and instance attributes.
+
+  * **ssm** – Allows principals to describe SSM managed instances, retrieve SSM Run Command documents required for VSS restore operations, send commands to instances, and list command invocations and executions.
+
+
+
+
+To view the permissions for this policy, see [AWSEC2VssRestorePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSEC2VssRestorePolicy.html) in the _AWS Managed Policy Reference_.
+
@@ -32,0 +50 @@ Change | Description | Date
+AWSEC2VssRestorePolicy – New policy | Added the **AWSEC2VssRestorePolicy** policy that can be attached to the IAM role assumed by the `AWSEC2-RestoreSqlServerDatabaseWithVss` automation runbook for restoring Microsoft SQL Server databases from VSS snapshots. | March 25, 2026