AWS systems-manager medium security documentation change
Summary
Added documentation for two new managed policies (AWSQuickSetupPatchPolicyLambdaExecutionPolicy and AWSQuickSetupPatchPolicyTagManagementExecutionPolicy) supporting Quick Setup patch policies. Updated AWSQuickSetupManagedInstanceProfileExecutionPolicy documentation with new permissions structure. Added changelog entries for these policy updates.
Security assessment
The change adds explicit security hardening through a Deny statement in AWSQuickSetupManagedInstanceProfileExecutionPolicy that prevents modification of Quick Setup automation roles, addressing privilege escalation risks. It also documents new policies enabling patching operations (security feature) and adds IAM condition restrictions limiting role passing to Systems Manager only.
Diff
diff --git a/systems-manager/latest/userguide/security-iam-awsmanpol.md b/systems-manager/latest/userguide/security-iam-awsmanpol.md index 079219a74..e69b5210f 100644 --- a//systems-manager/latest/userguide/security-iam-awsmanpol.md +++ b//systems-manager/latest/userguide/security-iam-awsmanpol.md @@ -7 +7 @@ -AmazonSSMServiceRolePolicyAmazonSSMAutomationRoleAmazonSSMReadOnlyAccessAWSSystemsManagerOpsDataSyncServiceRolePolicyAmazonSSMManagedEC2InstanceDefaultPolicySSMQuickSetupRolePolicyAWSQuickSetupDeploymentRolePolicyAWSQuickSetupPatchPolicyDeploymentRolePolicyAWSQuickSetupPatchPolicyBaselineAccessAWSSystemsManagerEnableExplorerExecutionPolicyAWSSystemsManagerEnableConfigRecordingExecutionPolicyAWSQuickSetupDevOpsGuruPermissionsBoundaryAWSQuickSetupDistributorPermissionsBoundaryAWSQuickSetupSSMHostMgmtPermissionsBoundaryAWSQuickSetupPatchPolicyPermissionsBoundaryAWSQuickSetupSchedulerPermissionsBoundaryAWSQuickSetupCFGCPacksPermissionsBoundaryAWSQuickSetupStartStopInstancesExecutionPolicyAWSQuickSetupStartSSMAssociationsExecutionPolicyAWS-SSM-DiagnosisAutomation-AdministrationRolePolicyAWS-SSM-DiagnosisAutomation-ExecutionRolePolicyAWS-SSM-RemediationAutomation-AdministrationRolePolicyAWS-SSM-RemediationAutomation-ExecutionRolePolicyAWSQuickSetupSSMManageResourcesExecutionPolicyAWSQuickSetupSSMLifecycleManagementExecutionPolicyAWSQuickSetupSSMDeploymentRolePolicyAWSQuickSetupSSMDeploymentS3BucketRolePolicyAWSQuickSetupEnableDHMCExecutionPolicyAWSQuickSetupEnableAREXExecutionPolicyAWSQuickSetupManagedInstanceProfileExecutionPolicyAWSQuickSetupManageJITNAResourcesExecutionPolicyAWSQuickSetupJITNADeploymentRolePolicyAWSSystemsManagerJustInTimeAccessServicePolicyAWSSystemsManagerJustInTimeAccessTokenPolicyAWSSystemsManagerJustInTimeAccessTokenSessionPolicyAWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicyAWSSystemsManagerNotificationsServicePolicyAWS-SSM-Automation-DiagnosisBucketPolicyAWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicyAWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicyPolicy updatesAdditional managed policies for Systems Manager +AmazonSSMServiceRolePolicyAmazonSSMAutomationRoleAmazonSSMReadOnlyAccessAWSSystemsManagerOpsDataSyncServiceRolePolicyAmazonSSMManagedEC2InstanceDefaultPolicySSMQuickSetupRolePolicyAWSQuickSetupDeploymentRolePolicyAWSQuickSetupPatchPolicyDeploymentRolePolicyAWSQuickSetupPatchPolicyBaselineAccessAWSQuickSetupPatchPolicyLambdaExecutionPolicyAWSQuickSetupPatchPolicyTagManagementExecutionPolicyAWSSystemsManagerEnableExplorerExecutionPolicyAWSSystemsManagerEnableConfigRecordingExecutionPolicyAWSQuickSetupDevOpsGuruPermissionsBoundaryAWSQuickSetupDistributorPermissionsBoundaryAWSQuickSetupSSMHostMgmtPermissionsBoundaryAWSQuickSetupPatchPolicyPermissionsBoundaryAWSQuickSetupSchedulerPermissionsBoundaryAWSQuickSetupCFGCPacksPermissionsBoundaryAWSQuickSetupStartStopInstancesExecutionPolicyAWSQuickSetupStartSSMAssociationsExecutionPolicyAWS-SSM-DiagnosisAutomation-AdministrationRolePolicyAWS-SSM-DiagnosisAutomation-ExecutionRolePolicyAWS-SSM-RemediationAutomation-AdministrationRolePolicyAWS-SSM-RemediationAutomation-ExecutionRolePolicyAWSQuickSetupSSMManageResourcesExecutionPolicyAWSQuickSetupSSMLifecycleManagementExecutionPolicyAWSQuickSetupSSMDeploymentRolePolicyAWSQuickSetupSSMDeploymentS3BucketRolePolicyAWSQuickSetupEnableDHMCExecutionPolicyAWSQuickSetupEnableAREXExecutionPolicyAWSQuickSetupManagedInstanceProfileExecutionPolicyAWSQuickSetupManageJITNAResourcesExecutionPolicyAWSQuickSetupJITNADeploymentRolePolicyAWSSystemsManagerJustInTimeAccessServicePolicyAWSSystemsManagerJustInTimeAccessTokenPolicyAWSSystemsManagerJustInTimeAccessTokenSessionPolicyAWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicyAWSSystemsManagerNotificationsServicePolicyAWS-SSM-Automation-DiagnosisBucketPolicyAWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicyAWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicyPolicy updatesAdditional managed policies for Systems Manager @@ -38,0 +39,4 @@ For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM + * AWS managed policy: AWSQuickSetupPatchPolicyLambdaExecutionPolicy + + * AWS managed policy: AWSQuickSetupPatchPolicyTagManagementExecutionPolicy + @@ -487,0 +492,42 @@ To view more details about the policy, including the latest version of the JSON +## AWS managed policy: AWSQuickSetupPatchPolicyLambdaExecutionPolicy + +The managed policy `AWSQuickSetupPatchPolicyLambdaExecutionPolicy` supports the [Configure patching for instances in an organization using a Quick Setup patch policy](./quick-setup-patch-manager.html) Quick Setup type. This configuration type helps automate patching of applications and nodes in a single account or across your organization. + +You can attach `AWSQuickSetupPatchPolicyLambdaExecutionPolicy` to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf. + +This policy grants permissions to manage State Manager associations for automated cleanup operations when Quick Setup configurations are deleted. + +**Permissions details** + +This policy includes the following permissions. + + * `ssm` – Allows principals to query and update State Manager associations by ID during automated cleanup operations. The policy grants permissions to describe association details, view association execution history, and update association configurations. Wildcard resources are required because association ARNs are dynamically generated. + + * `iam` – Allows principals to pass automation roles to Systems Manager for association operations. The permission is scoped to Quick Setup automation roles with the pattern `AWS-QuickSetup-AutomationRole-*` and includes a condition that restricts role passing to the Systems Manager service only. + + + + +To view more details about the policy, including the latest version of the JSON policy document, see [AWSQuickSetupPatchPolicyLambdaExecutionPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSQuickSetupPatchPolicyLambdaExecutionPolicy.html) in the _AWS Managed Policy Reference Guide_. + +## AWS managed policy: AWSQuickSetupPatchPolicyTagManagementExecutionPolicy + +The managed policy `AWSQuickSetupPatchPolicyTagManagementExecutionPolicy` supports the [Configure patching for instances in an organization using a Quick Setup patch policy](./quick-setup-patch-manager.html) Quick Setup type. This configuration type helps automate patching of applications and nodes in a single account or across your organization. + +You can attach `AWSQuickSetupPatchPolicyTagManagementExecutionPolicy` to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf. + +This policy grants permissions to track which instances are managed by Quick Setup patch policy configurations through automated tagging and inventory collection. + +**Permissions details** + +This policy includes the following permissions. + + * `ssm` – Allows principals to retrieve inventory information from managed instances; and to add or remove configuration tracking tags on SSM managed instances. + + * `ec2` – Allows principals to add or remove configuration tracking tags on Amazon EC2 instances. + + + + +To view more details about the policy, including the latest version of the JSON policy document, see [AWSQuickSetupPatchPolicyTagManagementExecutionPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSQuickSetupPatchPolicyTagManagementExecutionPolicy.html) in the _AWS Managed Policy Reference Guide_. + @@ -1014 +1060 @@ To view more details about the policy, including the latest version of the JSON -This policy grants administrative permissions that allow Systems Manager to create a default IAM instance profile for the Quick Setup tool, and to attach it to Amazon EC2 instances that don't already have an instance profile attached. The policy also grants Systems Manager the ability to attach permissions to existing instance profiles. This is done to ensure that the permissions required for Systems Manager to communicate with SSM Agent on EC2 instances are in place. +This policy grants administrative permissions that allow Systems Manager to create a default IAM instance profile for the Quick Setup capability and attach it to Amazon EC2 instances that don't already have an instance profile attached. @@ -1022 +1068 @@ This policy includes the following permissions. - * `ssm` – Allows principals to start automation workflows associated with Quick Setup processes. + * `ec2` – Allows principals to associate IAM instance profiles to Amazon EC2 instances and retrieve information about instance profile associations and instances. @@ -1024 +1070 @@ This policy includes the following permissions. - * `ec2` – Allows principals to attach IAM instance profiles to EC2 instances that are managed by Quick Setup. + * `iam` – Allows principals to create and manage the default IAM role and instance profile for Quick Setup, attach managed policies to roles, tag roles, and pass roles to Amazon EC2 and Systems Manager services. @@ -1026 +1072 @@ This policy includes the following permissions. - * `iam` – Allows principals to create, update, and retrieve information about roles from IAM that are used in Quick Setup processes; to create IAM instance profiles; to attach the `AmazonSSMManagedInstanceCore` managed policy to IAM instance profiles. + * `ssm` – Allows principals to start and monitor automation executions, retrieve instance information, update managed instance roles, and add tags to automation resources. @@ -1276,0 +1323,3 @@ Change | Description | Date +AWSQuickSetupPatchPolicyLambdaExecutionPolicy – New managed policy | Systems Manager added a new managed policy `AWSQuickSetupPatchPolicyLambdaExecutionPolicy` that grants permissions to manage State Manager associations for automated cleanup operations when Quick Setup configurations are deleted. | June 3, 2026 +AWSQuickSetupPatchPolicyTagManagementExecutionPolicy – New managed policy | Systems Manager added a new managed policy to enable Quick Setup patch policy configurations to track which instances are managed through automated tagging and inventory collection. The policy grants permissions to add or remove QSConfigName-* tags on Amazon EC2 instances and SSM managed instances, along with SSM inventory retrieval capabilities. | June 3, 2026 +AWSQuickSetupManagedInstanceProfileExecutionPolicy – Updated managed policy | Systems Manager updated the managed policy to support Quick Setup PatchPolicy migration from CloudFormation inline policies to managed policies. The update adds automation execution capabilities including instance discovery, role updates, role tagging, and expanded PassRole permissions to Systems Manager. A protective Deny statement prevents modification of Quick Setup automation roles. | June 3, 2026