AWS security-ir medium security documentation change

Service: security-ir · 2026-04-25 · Security-related medium

File: security-ir/latest/userguide/containment-with-ec2-triage-template.md

Summary

Updated CloudFormation template ARNs from 'automation-definition' to 'document' format and added automation-execution permission

Security assessment

This change updates security incident response containment templates. The ARN format change and addition of automation-execution permissions could affect how security containment actions are authorized and executed during incidents.

Diff

diff --git a/security-ir/latest/userguide/containment-with-ec2-triage-template.md b/security-ir/latest/userguide/containment-with-ec2-triage-template.md
index 7c7ec9919..4dc893a33 100644
--- a//security-ir/latest/userguide/containment-with-ec2-triage-template.md
+++ b//security-ir/latest/userguide/containment-with-ec2-triage-template.md
@@ -50,3 +50,4 @@ This template creates the containment roles with additional permissions for EC2
-                            !Sub 'arn:${AWS::Partition}:ssm:*:*:automation-definition/AWSSupport-ContainEC2Instance:$DEFAULT',
-                            !Sub 'arn:${AWS::Partition}:ssm:*:*:automation-definition/AWSSupport-ContainS3Resource:$DEFAULT',
-                            !Sub 'arn:${AWS::Partition}:ssm:*:*:automation-definition/AWSSupport-ContainIAMPrincipal:$DEFAULT',
+                            !Sub 'arn:${AWS::Partition}:ssm:*::document/AWSSupport-ContainEC2Instance',
+                            !Sub 'arn:${AWS::Partition}:ssm:*::document/AWSSupport-ContainS3Resource',
+                            !Sub 'arn:${AWS::Partition}:ssm:*::document/AWSSupport-ContainIAMPrincipal',
+                            !Sub 'arn:${AWS::Partition}:ssm:*:${AWS::AccountId}:automation-execution/*',