AWS systems-manager: Release note: IAM guidance for restricting Parameter Store access
Summary
Adds release-history entries describing new IAM guidance on how Parameter Store authorizes parameter retrieval (restricting access to parameters/paths and restricting SecureString decryption), plus a Lambda extension INIT-phase note.
Security assessment
The entry documents new IAM authorization guidance for Parameter Store, including restricting access to specific parameters/paths and restricting decryption of SecureString values. This is authorization/encryption-related security documentation (least-privilege IAM and SecureString decryption control), though it describes documentation rather than a fixed vulnerability.
Evidence
+Updated IAM guidance for restricting access to Parameter Store parameters| Explained how Parameter Store authorizes each parameter retrieval operation, so that you can write IAM policies that restrict access to parameters and parameter paths as you intend. For more information, see the following topics:
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-release-history.md b/systems-manager/latest/userguide/systems-manager-release-history.md index f00f6b0b6..00ce585ee 100644 --- a//systems-manager/latest/userguide/systems-manager-release-history.md +++ b//systems-manager/latest/userguide/systems-manager-release-history.md @@ -14,0 +15,8 @@ Change| Description| Date +Updated IAM guidance for restricting access to Parameter Store parameters| Explained how Parameter Store authorizes each parameter retrieval operation, so that you can write IAM policies that restrict access to parameters and parameter paths as you intend. For more information, see the following topics: + + * [How Parameter Store authorizes parameter retrieval](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-retrieval-authorization.html) + * [Restricting access to specific parameters and paths](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-parameter-access.html) + * [Restricting decryption of `SecureString` parameter values](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-decryption.html) + +| September 21, 2026 +AWS Parameters and Secrets Lambda Extension supports the INIT phase| The AWS Parameters and Secrets Lambda Extension can now be called during the `INIT` phase of a Lambda function, in addition to the `INVOKE` phase. The documentation no longer states that calls are limited to the `INVOKE` phase. For more information, see [Using Parameter Store parameters in Lambda functions](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.html).| September 21, 2026