AWS systems-manager medium security documentation change
Summary
Updated CloudWatch alarm integration documentation and removed IAM permission requirement
Security assessment
Eliminates unnecessary IAM privilege requirement while clarifying security monitoring integration
Diff
diff --git a/systems-manager/latest/userguide/running-simple-automations.md b/systems-manager/latest/userguide/running-simple-automations.md index 47827a21f..b36d82543 100644 --- a//systems-manager/latest/userguide/running-simple-automations.md +++ b//systems-manager/latest/userguide/running-simple-automations.md @@ -59 +59 @@ You can view information about a runbook by choosing the runbook name. - 8. (Optional) Choose a CloudWatch alarm to apply to your automation for monitoring. To attach a CloudWatch alarm to your automation, the IAM principal that starts the automation must have permission for the `iam:createServiceLinkedRole` action. For more information about CloudWatch alarms, see [Using Amazon CloudWatch alarms](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html). Note that if your alarm activates, the automation is stopped. If you use AWS CloudTrail, you will see the API call in your trail. + 8. (Optional) Choose a CloudWatch alarm to apply to your automation for monitoring. If your alarm enters `ALARM` state, the automation is canceled and any defined `onCancel` steps run. If you use AWS CloudTrail, you will see the `StopAutomationExecution` API call in your trail. For more information, see [Configuring Automations to monitor CloudWatch Alarms](./automation-cw-alarm-monitoring.html).