AWS Session Manager: less infrastructure, more features

Re:AWS Session Manager: less infrastructure, more features by jcrites on Monday March 16, 2020 @04:02PM (#22596954)

> The documentation suggests adding the AmazonEC2RoleforSSM policy to the role of the EC2 instances

Which documentation do you mean? The article mentions the policy AmazonSSMManagedInstanceCore, which is the same as what's mentioned in the SSM setup guide:

https://docs.aws.amazon.com/systems-manager/latest/userguide...

[ Parent | on HN ]

Re:AWS Session Manager: less infrastructure, more features by mishappen on Monday March 16, 2020 @06:59PM (#22599155)

Thanks for clarifying, I didn’t recheck since we rolled out SSM in mid-2019 and then scrambled when we realised we’d granted account wide S3 permissions. The article I linked to also has a recommended minimal IAM policy for Run Command and SSM. I’ll update my comment to mention this.

[ Parent | on HN ]

Re:AWS Session Manager: less infrastructure, more features by mishappen on Tuesday March 17, 2020 @12:31AM (#22601689)

It looks like the docs were update in June 2019 (https://github.com/awsdocs/aws-systems-manager-user-guide/co...)

[ Parent | on HN ]

Re:AWS Session Manager: less infrastructure, more features by x3n0ph3n3 on Monday March 16, 2020 @08:23PM (#22599951)

AmazonSSMManagedInstanceCore is still too much access, it has unscoped ssm:GetParameter! I hope you weren't trying to protect any secrets in ParameterStore!

[ Parent | on HN ]

Re:AWS Session Manager: less infrastructure, more features by acdha on Monday March 16, 2020 @09:25PM (#22600483)

Doesn’t that still fail if you don’t also have the corresponding decrypt KMS permission?

[ Parent | on HN ]