SSM Document Should Not Be Public

More Info:

Ensure SSM Documents are not public

Risk Level

High

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
HITRUST CSF
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
Reserve Bank of India (RBI) Cyber Security Framework
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the issue of SSM document being public in AWS EC2 using the AWS console, follow these steps:

Login to AWS Console: Go to the AWS Management Console and login with your credentials.
Navigate to Systems Manager (SSM): Go to the AWS Systems Manager service by typing "Systems Manager" in the search bar and selecting it from the dropdown.
Access SSM Documents: In the Systems Manager console, navigate to the left-hand menu and click on "Documents" under the "Shared Resources" section.
Identify Public SSM Documents: Look through the list of SSM documents to identify the ones that are marked as public. These will have a permission setting indicating that they are public.
Change Document Permissions:
- Select the public SSM document by clicking on it.
- Click on the "Edit" button to modify the document permissions.
- In the document permissions settings, change the visibility from public to private.
- Save the changes.
Verify Changes: After changing the permissions, verify that the SSM document is no longer public by checking the permissions settings.
Monitor for Compliance: Regularly monitor the SSM documents to ensure that they are not set to public in the future.

By following these steps, you can remediate the issue of SSM documents being public in AWS EC2 using the AWS console.

Using CLI

To remediate the issue of an SSM Document being public in AWS EC2 using AWS CLI, follow these steps:

Identify the public SSM Documents: Run the following AWS CLI command to list all public SSM Documents:
```
aws ssm list-documents --filters Key=Owner,Values=Public
```
Update the SSM Document to be private: You will need to update the SSM Document to be private. You can do this by running the following AWS CLI command:
```
aws ssm modify-document-permission --name "DOCUMENT_NAME" --permission-type "PRIVATE"
```
Replace DOCUMENT_NAME with the name of the public SSM Document that you want to make private.
Verify the SSM Document is now private: To confirm that the SSM Document is now private, you can run the following AWS CLI command:
```
aws ssm describe-document --name "DOCUMENT_NAME"
```
Replace DOCUMENT_NAME with the name of the SSM Document you updated.

By following these steps, you can successfully remediate the issue of an SSM Document being public in AWS EC2 using AWS CLI.

Using Python

To remediate the misconfiguration of having an SSM Document public for AWS EC2 instances using Python, you can follow these steps:

    # Remove the "All" option from the document permissions
    response = ssm_client.modify_document_permission(
        Name=document_name,
        PermissionType='Share',
        AccountIds=[],
        SharedDocumentVersion=None
    )
    print(f"Permissions updated for SSM document '{document_name}'.")

def main():
    # Specify the name of the SSM document to remediate
    document_name = 'your-ssm-document-name'

    # Remediate SSM document permissions
    remediate_ssm_document_permission(document_name)

if __name__ == "__main__":
    main()

Replace 'your-ssm-document-name' with the name of the SSM document you want to remediate. This script removes the "All" option from the document permissions to ensure it is not shared with all accounts. Adjust the script as needed to fit your environment and document permissions.

Using Terraform

resource "aws_ssm_document" "SSM_DOCUMENT_NAME" {
  name          = "SSM_DOCUMENT_NAME"            # replace with your document name
  document_type = "Command"
  content       = file("PATH_TO_DOCUMENT_JSON")  # replace with your document content path
}

# Remove public access: do NOT include "all" in account_ids
resource "aws_ssm_document_permission" "ssm_document_share" {
  name            = aws_ssm_document.SSM_DOCUMENT_NAME.name
  permission_type = "Share"

  # Option 1: keep private (no shares)
  # account_ids = []

  # Option 2: share only with specific accounts (still not public)
  account_ids = [
    "ALLOWED_AWS_ACCOUNT_ID_1",  # replace with permitted AWS account IDs
    "ALLOWED_AWS_ACCOUNT_ID_2",
  ]
}

Changing account_ids from ["all"] to a specific list (or an empty list) does not force replacement of the SSM Document; it only updates its permissions in place, but it will immediately make the document non-public once applied.

Verification: terraform plan should show an update to aws_ssm_document_permission.ssm_document_share where account_ids no longer contains "all" (or that the permission resource is being destroyed if you make it fully private).

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​