AWS cli: SSM get-parameter-history: warning on GetParameter deny bypass
Summary
Adds a Warning that GetParameterHistory is authorized against ssm:GetParameterHistory, not ssm:GetParameter, so a principal denied GetParameter/GetParameters/GetParametersByPath but allowed GetParameterHistory can still read the current parameter value; also adds a --help flag and version bump.
Security assessment
The warning documents a data-disclosure authorization bypass: denying the standard read actions does not block reading the current secret/parameter value through GetParameterHistory, so incomplete deny policies can leak sensitive parameter values. This is an access-control/confidentiality issue.
Evidence
+This operation is authorized against the `ssm:GetParameterHistory` action, not against `ssm:GetParameter` . Because parameter history includes every version of a parameter, including the current one, a principal who is denied `ssm:GetParameter` , `ssm:GetParameters` , and `ssm:GetParametersByPath` but allowed `ssm:GetParameterHistory` can still read the current value. To restrict access to a parameter value, deny every action that can return it. For more information, see [How Parameter Store authorizes parameter retrieval](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-retrieval-authorization.html) in the _Amazon Web Services Systems Manager User Guide_ .
Diff
diff --git a/cli/latest/reference/ssm/get-parameter-history.md b/cli/latest/reference/ssm/get-parameter-history.md index cb4ae08..d0f0f2e 100644 --- a//cli/latest/reference/ssm/get-parameter-history.md +++ b//cli/latest/reference/ssm/get-parameter-history.md @@ -15 +15 @@ - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) » @@ -67,0 +68,4 @@ If you change the KMS key alias for the KMS key used to encrypt a parameter, the +### Warning + +This operation is authorized against the `ssm:GetParameterHistory` action, not against `ssm:GetParameter` . Because parameter history includes every version of a parameter, including the current one, a principal who is denied `ssm:GetParameter` , `ssm:GetParameters` , and `ssm:GetParametersByPath` but allowed `ssm:GetParameterHistory` can still read the current value. To restrict access to a parameter value, deny every action that can return it. For more information, see [How Parameter Store authorizes parameter retrieval](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-retrieval-authorization.html) in the _Amazon Web Services Systems Manager User Guide_ . + @@ -101,0 +106 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20 + [--help] @@ -256,0 +262,4 @@ The formatting style for error output. By default, errors are displayed in enhan +`--help` (boolean) + +Display help for the command/subcommand. + @@ -485 +494 @@ NextToken -> (string) - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) »