AWS systems-manager: Tighten Session Manager OpenDataChannel IAM policy with session-id condition
Summary
Multiple example IAM policies in the Session Manager restrict-access quickstart were rewritten: the standalone ssmmessages:OpenDataChannel statement was removed and the action merged into the ssm:StartSession/ResumeSession statement, with the resource broadened to arn:aws:ssm:*:*:session/* but constrained by a StringEquals condition on the ssm:resourceTag/aws:ssmmessages:session-id tag matching ${aws:userid}.
Security assessment
The change replaces a name-pattern resource ARN (session/${aws:userid}-*) with an explicit tag-based condition tying the data channel to the caller's own session, preventing a user from opening a data channel to another user's Session Manager session (session hijacking / cross-user access). This is a concrete authorization-hardening fix in the documented IAM policies.
Evidence
+ "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}"
Diff
diff --git a/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.md b/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.md index 9b67a67..653b370 100644 --- a//systems-manager/latest/userguide/getting-started-restrict-access-quickstart.md +++ b//systems-manager/latest/userguide/getting-started-restrict-access-quickstart.md @@ -64,5 +63,0 @@ JSON - }, - { - "Effect": "Allow", - "Action": ["ssmmessages:OpenDataChannel"], - "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] @@ -84 +79,2 @@ JSON - "ssm:ResumeSession" + "ssm:ResumeSession", + "ssmmessages:OpenDataChannel" @@ -86,3 +82,6 @@ JSON - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:userid}-*" - ] + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + } @@ -128,5 +126,0 @@ JSON - }, - { - "Effect": "Allow", - "Action": ["ssmmessages:OpenDataChannel"], - "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] @@ -146 +140,2 @@ JSON - "ssm:ResumeSession" + "ssm:ResumeSession", + "ssmmessages:OpenDataChannel" @@ -148,3 +143,6 @@ JSON - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:username}-*" - ] + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + } @@ -183,5 +180,0 @@ JSON - }, - { - "Effect": "Allow", - "Action": ["ssmmessages:OpenDataChannel"], - "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] @@ -193 +186,2 @@ JSON - "ssm:ResumeSession" + "ssm:ResumeSession", + "ssmmessages:OpenDataChannel" @@ -195,3 +189,6 @@ JSON - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:userid}-*" - ] + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + } @@ -274,9 +270,0 @@ JSON - { - "Effect": "Allow", - "Action": [ - "ssmmessages:OpenDataChannel" - ], - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:userid}-*" - ] - }, @@ -303,9 +290,0 @@ JSON - { - "Effect": "Allow", - "Action": [ - "ssmmessages:OpenDataChannel" - ], - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:userid}-*" - ] - }, @@ -316 +295,2 @@ JSON - "ssm:ResumeSession" + "ssm:ResumeSession", + "ssmmessages:OpenDataChannel" @@ -318,3 +298,6 @@ JSON - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:userid}-*" - ] + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + } @@ -368,5 +350,0 @@ JSON - }, - { - "Effect": "Allow", - "Action": ["ssmmessages:OpenDataChannel"], - "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] @@ -386 +364,2 @@ JSON - "ssm:ResumeSession" + "ssm:ResumeSession", + "ssmmessages:OpenDataChannel" @@ -388,3 +367,6 @@ JSON - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:userid}-*" - ] + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + } @@ -429,5 +410,0 @@ JSON - }, - { - "Effect": "Allow", - "Action": ["ssmmessages:OpenDataChannel"], - "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] @@ -460 +437,2 @@ JSON - "ssm:ResumeSession" + "ssm:ResumeSession", + "ssmmessages:OpenDataChannel" @@ -462,3 +440,6 @@ JSON - "Resource": [ - "arn:aws:ssm:*:*:session/${aws:userid}-*" - ] + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + }