AWS imagebuilder: Remove over-broad Systems Manager automation permissions from policy docs
Summary
Removes documentation of permissions to start/stop Systems Manager automation executions for any resource in the account, and fixes a typo in ec2:DescribeInstanceTypeOfferings.
Security assessment
The diff removes the previously documented ability to 'stop automation executions for any resource in your account' and to start automation executions, reflecting a reduction of over-broad IAM permissions (least privilege) in the managed policy documentation.
Evidence
* **Systems Manager** – Access is granted for Image Builder to list Systems Manager commands and their invocations, inventory entries , describe instance information, describe hosts for instance placement support, and get command invocation details.
Diff
diff --git a/imagebuilder/latest/userguide/security-iam-awsmanpol.md b/imagebuilder/latest/userguide/security-iam-awsmanpol.md index a5e21e9..3416145 100644 --- a//imagebuilder/latest/userguide/security-iam-awsmanpol.md +++ b//imagebuilder/latest/userguide/security-iam-awsmanpol.md @@ -99 +99 @@ Image Builder can also attach AMI watermarks to images tagged `CreatedBy: EC2 Im - * **Systems Manager** – Access is granted for Image Builder to list Systems Manager commands and their invocations, inventory entries , describe instance information and automation execution statuses, describe hosts for instance placement support, and get command invocation details. Image Builder can also send automation signals, and stop automation executions for any resource in your account. + * **Systems Manager** – Access is granted for Image Builder to list Systems Manager commands and their invocations, inventory entries , describe instance information, describe hosts for instance placement support, and get command invocation details. @@ -101 +101 @@ Image Builder can also attach AMI watermarks to images tagged `CreatedBy: EC2 Im -Image Builder is able to issue run command invocations to any instance that is tagged `"CreatedBy": "EC2 Image Builder"` for the following script files: `AWS-RunPowerShellScript`, `AWS-RunShellScript`, or `AWSEC2-RunSysprep`. Image Builder is able to start an Systems Manager automation execution in your account for automation documents where the name starts with `ImageBuilder`. +Image Builder is able to issue run command invocations to any instance that is tagged `"CreatedBy": "EC2 Image Builder"` for the following script files: `AWS-RunPowerShellScript`, `AWS-RunShellScript`, or `AWSEC2-RunSysprep`. @@ -350,2 +350,2 @@ AWSImageBuilderFullAccess – Update to an existing policy | Image Builder made - * Added permissions to allow `ec2:DescribeInstanceTypeOffereings`. - * Added permissions to call `ec2:DescribeInstanceTypeOffereings` to enable the Image Builder console to accurately reflect the instance types that are available in the account. + * Added permissions to allow `ec2:DescribeInstanceTypeOfferings`. + * Added permissions to call `ec2:DescribeInstanceTypeOfferings` to enable the Image Builder console to accurately reflect the instance types that are available in the account.