AWS cli: SSM get-parameters: warning that ssm:GetParameter deny is insufficient
Summary
Adds a warning that GetParameters is authorized against ssm:GetParameters, not ssm:GetParameter, so denying ssm:GetParameter does not prevent retrieval of a parameter value; advises denying every action that can return it; also adds --help and bumps the CLI version.
Security assessment
Documents that an IAM deny on ssm:GetParameter can be bypassed by calling GetParameters, which is authorized against a different action, allowing a principal to read a parameter value it was intended to be denied. Security-relevant authorization guidance with mitigation advice, but no specific CVE or fix.
Evidence
+This operation is authorized against the `ssm:GetParameters` action, not against `ssm:GetParameter` . Denying `ssm:GetParameter` for a parameter doesn’t prevent a principal from retrieving that parameter with this operation. To restrict access to a parameter value, deny every action that can return it. For more information, see [How Parameter Store authorizes parameter retrieval](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-retrieval-authorization.html) in the _Amazon Web Services Systems Manager User Guide_ .
Diff
diff --git a/cli/latest/reference/ssm/get-parameters.md b/cli/latest/reference/ssm/get-parameters.md index 8935391..591874d 100644 --- a//cli/latest/reference/ssm/get-parameters.md +++ b//cli/latest/reference/ssm/get-parameters.md @@ -15 +15 @@ - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) » @@ -65,0 +66,4 @@ To get information about a single parameter, you can use the GetParameter operat +### Warning + +This operation is authorized against the `ssm:GetParameters` action, not against `ssm:GetParameter` . Denying `ssm:GetParameter` for a parameter doesn’t prevent a principal from retrieving that parameter with this operation. To restrict access to a parameter value, deny every action that can return it. For more information, see [How Parameter Store authorizes parameter retrieval](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-retrieval-authorization.html) in the _Amazon Web Services Systems Manager User Guide_ . + @@ -102,0 +107 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ssm-20 + [--help] @@ -255,0 +261,4 @@ The formatting style for error output. By default, errors are displayed in enhan +`--help` (boolean) + +Display help for the command/subcommand. + @@ -490 +499 @@ InvalidParameters -> (list) - * [AWS CLI 2.39.5 Command Reference](../../index.html) » + * [AWS CLI 2.39.6 Command Reference](../../index.html) »