AWS systems-manager: Scope OpenDataChannel to caller's session via session-id tag condition

Service: systems-manager · 2026-11-07 · Security-related high

File: systems-manager/latest/userguide/session-manager-restrict-command-access.md · Type: authz

Summary

Three example policies in the restrict-command-access page were changed from a separate ssmmessages:OpenDataChannel statement scoped to session/${aws:userid}-* to a single statement using Resource arn:aws:ssm:*:*:session/* with a StringEquals condition on ssm:resourceTag/aws:ssmmessages:session-id = ${aws:userid}.

Security assessment

The condition enforces that the data channel can only be opened for a session tagged with the requesting user's ID, preventing cross-user session access that the previous ARN-pattern-only grant could allow. This is a least-privilege authorization fix in the documented IAM examples.

Evidence

+                      "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}"

Diff

diff --git a/systems-manager/latest/userguide/session-manager-restrict-command-access.md b/systems-manager/latest/userguide/session-manager-restrict-command-access.md
index c09eaa4..2ba17ff 100644
--- a//systems-manager/latest/userguide/session-manager-restrict-command-access.md
+++ b//systems-manager/latest/userguide/session-manager-restrict-command-access.md
@@ -327,2 +327,7 @@ JSON
-             "Action": ["ssmmessages:OpenDataChannel"],
-             "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"]
+              "Action": "ssmmessages:OpenDataChannel",
+              "Resource": "arn:aws:ssm:*:*:session/*",
+              "Condition": {
+                  "StringEquals": {
+                      "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}"
+                  }
+              }
@@ -357,2 +362,7 @@ JSON
-             "Action": ["ssmmessages:OpenDataChannel"],
-             "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"]
+              "Action": "ssmmessages:OpenDataChannel",
+              "Resource": "arn:aws:ssm:*:*:session/*",
+              "Condition": {
+                  "StringEquals": {
+                      "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}"
+                  }
+              }
@@ -388,2 +398,7 @@ JSON
-             "Action": ["ssmmessages:OpenDataChannel"],
-             "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"]
+              "Action": "ssmmessages:OpenDataChannel",
+              "Resource": "arn:aws:ssm:*:*:session/*",
+              "Condition": {
+                  "StringEquals": {
+                      "ssm:resourceTag/aws:ssmmessages:session-id": "${aws:userid}"
+                  }
+              }