AWS cli: SSM delete-parameter: note on DeleteParameter authorization
Summary
Adds a Note clarifying that DeleteParameter is authorized against ssm:DeleteParameter and that denying that action alone does not restrict DeleteParameters, linking to the Parameter Store access-restriction guide; also adds a --help flag and version bump.
Security assessment
The added note documents a concrete authorization gap: an IAM deny on ssm:DeleteParameter does not prevent deletion via the separately authorized DeleteParameters operation, so least-privilege policies must cover both actions. This is IAM authorization guidance with direct access-control impact.
Evidence
+This operation is authorized against the `ssm:DeleteParameter` action. Denying that action alone doesn’t restrict DeleteParameters , which is authorized against its own action. For more information, see [Restricting access to specific parameters and paths](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-parameter-access.html) in the _Amazon Web Services Systems Manager User Guide_ .
Diff
diff --git a/cli/latest/reference/ssm/delete-parameter.md b/cli/latest/reference/ssm/delete-parameter.md index b156d92..73a4bc3 100644 --- a//cli/latest/reference/ssm/delete-parameter.md +++ b//cli/latest/reference/ssm/delete-parameter.md @@ -15 +15 @@ - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) » @@ -61,0 +62,4 @@ Delete a parameter from the system. After deleting a parameter, wait for at leas +### Note + +This operation is authorized against the `ssm:DeleteParameter` action. Denying that action alone doesn’t restrict DeleteParameters , which is authorized against its own action. For more information, see [Restricting access to specific parameters and paths](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-parameter-access.html) in the _Amazon Web Services Systems Manager User Guide_ . + @@ -89,0 +94 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20 + [--help] @@ -219,0 +225,4 @@ The formatting style for error output. By default, errors are displayed in enhan +`--help` (boolean) + +Display help for the command/subcommand. + @@ -255 +264 @@ None - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) »