AWS systems-manager medium security documentation change

Service: systems-manager · 2026-07-10 · Security-related medium

File: systems-manager/latest/userguide/security-iam-awsmanpol.md

Summary

Added note about CloudWatch alarm monitoring using execution identity instead of service-linked role

Security assessment

Documents important security permission changes for automation monitoring, affecting least-privilege implementations

Diff

diff --git a/systems-manager/latest/userguide/security-iam-awsmanpol.md b/systems-manager/latest/userguide/security-iam-awsmanpol.md
index e69b5210f..3c268b5d8 100644
--- a//systems-manager/latest/userguide/security-iam-awsmanpol.md
+++ b//systems-manager/latest/userguide/security-iam-awsmanpol.md
@@ -131,0 +132,4 @@ This policy includes the following permissions.
+###### Note
+
+The `AmazonSSMServiceRolePolicy` includes `cloudwatch:DescribeAlarms` permission. However, Automation no longer uses the service-linked role for CloudWatch alarm monitoring. This operation now uses your runbook execution identity.
+