AWS systems-manager medium security documentation change

Service: systems-manager · 2026-06-25 · Security-related medium

File: systems-manager/latest/userguide/automation-action-changestate.md

Summary

Updated automation example from stopping to starting instances and added new 'FailOnUnexpectedStopped' parameter

Security assessment

The new 'FailOnUnexpectedStopped' parameter helps detect security-related misconfigurations (e.g. missing KMS permissions for encrypted volumes) by failing automation when instances unexpectedly stop during start operations.

Diff

diff --git a/systems-manager/latest/userguide/automation-action-changestate.md b/systems-manager/latest/userguide/automation-action-changestate.md
index f0f6e6db9..04d28e169 100644
--- a//systems-manager/latest/userguide/automation-action-changestate.md
+++ b//systems-manager/latest/userguide/automation-action-changestate.md
@@ -27 +27 @@ YAML
-    name: stopMyInstance
+    name: startMyInstance
@@ -36 +36,2 @@ YAML
-      DesiredState: stopped
+      DesiredState: running
+      FailOnUnexpectedStopped: true
@@ -43 +44 @@ JSON
-        "name":"stopMyInstance",
+        "name":"startMyInstance",
@@ -51 +52,2 @@ JSON
-            "DesiredState": "stopped"
+            "DesiredState": "running",
+            "FailOnUnexpectedStopped": true
@@ -94,0 +97,9 @@ Required: No
+FailOnUnexpectedStopped
+    
+
+If set to true, the automation step fails when an instance transitions to the stopped state during a start operation. This is useful for detecting cases where an instance fails to start successfully, such as when an instance has an encrypted EBS volume but lacks the required KMS key permissions.
+
+Type: Boolean
+
+Required: No
+