AWS cli: SSM get-parameters-by-path: warning on path-level authorization bypass
Summary
Replaces the old warning with a more explicit one stating the operation is authorized only against ssm:GetParametersByPath for the requested path, that recursive calls return every parameter under the path even if a policy explicitly denies access to a sub-path, and that denies must be applied to every ancestor path; also adds --help and bumps the CLI version.
Security assessment
The warning explicitly describes an authorization weakness where an explicit IAM deny on a child parameter (/a/b) is bypassed by a recursive GetParametersByPath call on an ancestor path (/a), enabling unauthorized disclosure of parameter values; it also gives concrete mitigation (deny the action on every ancestor path). This is a documented privilege/authorization bypass with data-exposure impact.
Evidence
+This operation is authorized against the `ssm:GetParametersByPath` action for the path that you specify in the request. It isn’t authorized against the individual parameters that it returns, and it isn’t authorized against `ssm:GetParameter` . A principal who is allowed to call this operation for the path `/a` with `Recursive` set to `true` receives every parameter under that path, including `/a/b` , even if a policy explicitly denies access to `/a/b` .
Diff
diff --git a/cli/latest/reference/ssm/get-parameters-by-path.md b/cli/latest/reference/ssm/get-parameters-by-path.md index c482ff1..65017db 100644 --- a//cli/latest/reference/ssm/get-parameters-by-path.md +++ b//cli/latest/reference/ssm/get-parameters-by-path.md @@ -15 +15 @@ - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) » @@ -61,0 +62,6 @@ Retrieve information about one or more parameters under a specified level in a h +### Warning + +This operation is authorized against the `ssm:GetParametersByPath` action for the path that you specify in the request. It isn’t authorized against the individual parameters that it returns, and it isn’t authorized against `ssm:GetParameter` . A principal who is allowed to call this operation for the path `/a` with `Recursive` set to `true` receives every parameter under that path, including `/a/b` , even if a policy explicitly denies access to `/a/b` . + +To prevent a parameter from being returned by this operation, deny the `ssm:GetParametersByPath` action on every ancestor path that could include the parameter in its results. For more information, see [Restricting access to specific parameters and paths](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-parameter-access.html) in the _Amazon Web Services Systems Manager User Guide_ . + @@ -101,0 +108 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20 + [--help] @@ -120,4 +126,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20 -> -> ### Warning -> -> If a user has access to a path, then the user can access all levels of that path. For example, if a user has permission to access path `/a` , then the user can also access `/a/b` . Even if a user has explicitly been denied access in IAM for parameter `/a/b` , they can still call the GetParametersByPath API operation recursively for `/a` and view `/a/b` . @@ -350,0 +354,4 @@ The formatting style for error output. By default, errors are displayed in enhan +`--help` (boolean) + +Display help for the command/subcommand. + @@ -496 +503 @@ NextToken -> (string) - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) »