AWS systems-manager: Add session-id tag condition to SSH-over-Session-Manager IAM policy
Summary
Two example IAM policies for enabling SSH connections through Session Manager were updated so the session resource is arn:aws:ssm:*:*:session/* with a StringEquals condition requiring ssm:resourceTag/aws:ssmmessages:session-id to equal ${aws:userid}.
Security assessment
The wildcard session resource is now gated by a condition that only permits the caller's own session, closing the possibility of attaching to or opening a data channel for another user's session. This is an authorization-scoping improvement in the documented policy.
Evidence
+ "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}"
Diff
diff --git a/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.md b/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.md index 18f6a84..c14b856 100644 --- a//systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.md +++ b//systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.md @@ -130 +130,6 @@ JSON - "Resource": "arn:aws:ssm:*:*:session/${aws:userid}-*" + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + } @@ -170 +175,6 @@ JSON - "Resource": "arn:aws:ssm:*:*:session/${aws:userid}-*" + "Resource": "arn:aws:ssm:*:*:session/*", + "Condition": { + "StringEquals": { + "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}" + } + }