AWS cli: SSM get-parameter: note on ssm:GetParameter authorization scope
Summary
Adds a note explaining that GetParameter is authorized against ssm:GetParameter and that denying that action alone does not restrict GetParameters, GetParameterHistory, or GetParametersByPath; also adds the --help option and bumps the CLI version to 2.39.6.
Security assessment
The added note documents an authorization weakness: an IAM deny on ssm:GetParameter does not block parameter retrieval via other Get* actions, so least-privilege policies must deny every retrieval action. This is security-relevant IAM guidance but documents existing behavior rather than fixing a specific vulnerability.
Evidence
+This operation is authorized against the `ssm:GetParameter` action. Denying that action alone doesn’t restrict GetParameters , GetParameterHistory , or GetParametersByPath , each of which is authorized against its own action. For more information, see [How Parameter Store authorizes parameter retrieval](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-retrieval-authorization.html) in the _Amazon Web Services Systems Manager User Guide_ .
Diff
diff --git a/cli/latest/reference/ssm/get-parameter.md b/cli/latest/reference/ssm/get-parameter.md index 164ce56..784f616 100644 --- a//cli/latest/reference/ssm/get-parameter.md +++ b//cli/latest/reference/ssm/get-parameter.md @@ -15 +15 @@ - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) » @@ -69,0 +70,4 @@ To get information about more than one parameter at a time, use the GetParameter +This operation is authorized against the `ssm:GetParameter` action. Denying that action alone doesn’t restrict GetParameters , GetParameterHistory , or GetParametersByPath , each of which is authorized against its own action. For more information, see [How Parameter Store authorizes parameter retrieval](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-retrieval-authorization.html) in the _Amazon Web Services Systems Manager User Guide_ . + +### Note + @@ -102,0 +107 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20 + [--help] @@ -236,0 +242,4 @@ The formatting style for error output. By default, errors are displayed in enhan +`--help` (boolean) + +Display help for the command/subcommand. + @@ -449 +458 @@ Parameter -> (structure) - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) »