Ssm document not public remediation

Using Console

To remediate the issue of SSM document being public in AWS EC2 using the AWS console, follow these steps:

Login to AWS Console: Go to the AWS Management Console and login with your credentials.
Navigate to Systems Manager (SSM): Go to the AWS Systems Manager service by typing “Systems Manager” in the search bar and selecting it from the dropdown.
Access SSM Documents: In the Systems Manager console, navigate to the left-hand menu and click on “Documents” under the “Shared Resources” section.
Identify Public SSM Documents: Look through the list of SSM documents to identify the ones that are marked as public. These will have a permission setting indicating that they are public.
Change Document Permissions:
- Select the public SSM document by clicking on it.
- Click on the “Edit” button to modify the document permissions.
- In the document permissions settings, change the visibility from public to private.
- Save the changes.
Verify Changes: After changing the permissions, verify that the SSM document is no longer public by checking the permissions settings.
Monitor for Compliance: Regularly monitor the SSM documents to ensure that they are not set to public in the future.

By following these steps, you can remediate the issue of SSM documents being public in AWS EC2 using the AWS console.

Using CLI

To remediate the issue of an SSM Document being public in AWS EC2 using AWS CLI, follow these steps:

Identify the public SSM Documents: Run the following AWS CLI command to list all public SSM Documents:
aws ssm list-documents --filters Key=Owner,Values=Public
Update the SSM Document to be private: You will need to update the SSM Document to be private. You can do this by running the following AWS CLI command:
aws ssm modify-document-permission --name "DOCUMENT_NAME" --permission-type "PRIVATE"
Replace DOCUMENT_NAME with the name of the public SSM Document that you want to make private.
Verify the SSM Document is now private: To confirm that the SSM Document is now private, you can run the following AWS CLI command:
aws ssm describe-document --name "DOCUMENT_NAME"
Replace DOCUMENT_NAME with the name of the SSM Document you updated.

By following these steps, you can successfully remediate the issue of an SSM Document being public in AWS EC2 using AWS CLI.

Using Python

To remediate the misconfiguration of having an SSM Document public for AWS EC2 instances using Python, you can follow these steps:

    # Remove the "All" option from the document permissions
    response = ssm_client.modify_document_permission(
        Name=document_name,
        PermissionType='Share',
        AccountIds=[],
        SharedDocumentVersion=None
    )
    print(f"Permissions updated for SSM document '{document_name}'.")

def main():
    # Specify the name of the SSM document to remediate
    document_name = 'your-ssm-document-name'

    # Remediate SSM document permissions
    remediate_ssm_document_permission(document_name)

if __name__ == "__main__":
    main()

Replace 'your-ssm-document-name' with the name of the SSM document you want to remediate. This script removes the “All” option from the document permissions to ensure it is not shared with all accounts. Adjust the script as needed to fit your environment and document permissions.

Using Terraform

resource "aws_ssm_document" "SSM_DOCUMENT_NAME" {
  name          = "SSM_DOCUMENT_NAME"            # replace with your document name
  document_type = "Command"
  content       = file("PATH_TO_DOCUMENT_JSON")  # replace with your document content path
}

# Remove public access: do NOT include "all" in account_ids
resource "aws_ssm_document_permission" "ssm_document_share" {
  name            = aws_ssm_document.SSM_DOCUMENT_NAME.name
  permission_type = "Share"

  # Option 1: keep private (no shares)
  # account_ids = []

  # Option 2: share only with specific accounts (still not public)
  account_ids = [
    "ALLOWED_AWS_ACCOUNT_ID_1",  # replace with permitted AWS account IDs
    "ALLOWED_AWS_ACCOUNT_ID_2",
  ]
}

Changing account_ids from ["all"] to a specific list (or an empty list) does not force replacement of the SSM Document; it only updates its permissions in place, but it will immediately make the document non-public once applied.Verification: terraform plan should show an update to aws_ssm_document_permission.ssm_document_share where account_ids no longer contains "all" (or that the permission resource is being destroyed if you make it fully private).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Ssm document not public remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation