> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ssm document not public remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the issue of SSM document being public in AWS EC2 using the AWS console, follow these steps:

        1. **Login to AWS Console**: Go to the AWS Management Console and login with your credentials.

        2. **Navigate to Systems Manager (SSM)**: Go to the AWS Systems Manager service by typing "Systems Manager" in the search bar and selecting it from the dropdown.

        3. **Access SSM Documents**: In the Systems Manager console, navigate to the left-hand menu and click on "Documents" under the "Shared Resources" section.

        4. **Identify Public SSM Documents**: Look through the list of SSM documents to identify the ones that are marked as public. These will have a permission setting indicating that they are public.

        5. **Change Document Permissions**:
           * Select the public SSM document by clicking on it.
           * Click on the "Edit" button to modify the document permissions.
           * In the document permissions settings, change the visibility from public to private.
           * Save the changes.

        6. **Verify Changes**: After changing the permissions, verify that the SSM document is no longer public by checking the permissions settings.

        7. **Monitor for Compliance**: Regularly monitor the SSM documents to ensure that they are not set to public in the future.

        By following these steps, you can remediate the issue of SSM documents being public in AWS EC2 using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the issue of an SSM Document being public in AWS EC2 using AWS CLI, follow these steps:

        1. **Identify the public SSM Documents**: Run the following AWS CLI command to list all public SSM Documents:
           ```
           aws ssm list-documents --filters Key=Owner,Values=Public
           ```

        2. **Update the SSM Document to be private**: You will need to update the SSM Document to be private. You can do this by running the following AWS CLI command:
           ```
           aws ssm modify-document-permission --name "DOCUMENT_NAME" --permission-type "PRIVATE"
           ```
           Replace `DOCUMENT_NAME` with the name of the public SSM Document that you want to make private.

        3. **Verify the SSM Document is now private**: To confirm that the SSM Document is now private, you can run the following AWS CLI command:
           ```
           aws ssm describe-document --name "DOCUMENT_NAME"
           ```
           Replace `DOCUMENT_NAME` with the name of the SSM Document you updated.

        By following these steps, you can successfully remediate the issue of an SSM Document being public in AWS EC2 using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of having an SSM Document public for AWS EC2 instances using Python, you can follow these steps:

        ```python theme={null}
            # Remove the "All" option from the document permissions
            response = ssm_client.modify_document_permission(
                Name=document_name,
                PermissionType='Share',
                AccountIds=[],
                SharedDocumentVersion=None
            )
            print(f"Permissions updated for SSM document '{document_name}'.")

        def main():
            # Specify the name of the SSM document to remediate
            document_name = 'your-ssm-document-name'

            # Remediate SSM document permissions
            remediate_ssm_document_permission(document_name)

        if __name__ == "__main__":
            main()
        ```

        Replace `'your-ssm-document-name'` with the name of the SSM document you want to remediate. This script removes the "All" option from the document permissions to ensure it is not shared with all accounts. Adjust the script as needed to fit your environment and document permissions.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_ssm_document" "SSM_DOCUMENT_NAME" {
          name          = "SSM_DOCUMENT_NAME"            # replace with your document name
          document_type = "Command"
          content       = file("PATH_TO_DOCUMENT_JSON")  # replace with your document content path
        }

        # Remove public access: do NOT include "all" in account_ids
        resource "aws_ssm_document_permission" "ssm_document_share" {
          name            = aws_ssm_document.SSM_DOCUMENT_NAME.name
          permission_type = "Share"

          # Option 1: keep private (no shares)
          # account_ids = []

          # Option 2: share only with specific accounts (still not public)
          account_ids = [
            "ALLOWED_AWS_ACCOUNT_ID_1",  # replace with permitted AWS account IDs
            "ALLOWED_AWS_ACCOUNT_ID_2",
          ]
        }
        ```

        Changing `account_ids` from `["all"]` to a specific list (or an empty list) does not force replacement of the SSM Document; it only updates its permissions in place, but it will immediately make the document non-public once applied.

        Verification: `terraform plan` should show an update to `aws_ssm_document_permission.ssm_document_share` where `account_ids` no longer contains `"all"` (or that the permission resource is being destroyed if you make it fully private).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>