AWS cli: SSM delete-parameters: warning on DeleteParameter deny bypass
Summary
Adds a Warning that DeleteParameters is authorized against ssm:DeleteParameters, not ssm:DeleteParameter, so denying ssm:DeleteParameter does not stop a principal from deleting a parameter through this bulk operation; also adds a --help flag and version bump.
Security assessment
The warning explicitly describes a permission-boundary bypass: a principal denied ssm:DeleteParameter can still destroy parameters via ssm:DeleteParameters, which is a destructive authorization weakness that administrators must account for in deny policies.
Evidence
+This operation is authorized against the `ssm:DeleteParameters` action, not against `ssm:DeleteParameter` . Denying `ssm:DeleteParameter` for a parameter doesn’t prevent a principal from deleting that parameter with this operation. For more information, see [Restricting access to specific parameters and paths](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-parameter-access.html) in the _Amazon Web Services Systems Manager User Guide_ .
Diff
diff --git a/cli/latest/reference/ssm/delete-parameters.md b/cli/latest/reference/ssm/delete-parameters.md index 2b6be66..cd42b4f 100644 --- a//cli/latest/reference/ssm/delete-parameters.md +++ b//cli/latest/reference/ssm/delete-parameters.md @@ -15 +15 @@ - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) » @@ -61,0 +62,4 @@ Delete a list of parameters. After deleting a parameter, wait for at least 30 se +### Warning + +This operation is authorized against the `ssm:DeleteParameters` action, not against `ssm:DeleteParameter` . Denying `ssm:DeleteParameter` for a parameter doesn’t prevent a principal from deleting that parameter with this operation. For more information, see [Restricting access to specific parameters and paths](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-parameter-access.html) in the _Amazon Web Services Systems Manager User Guide_ . + @@ -89,0 +94 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20 + [--help] @@ -234,0 +240,4 @@ The formatting style for error output. By default, errors are displayed in enhan +`--help` (boolean) + +Display help for the command/subcommand. + @@ -320 +329 @@ InvalidParameters -> (list) - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) »