SSM document contains no secrets

Check ID: ssm_document_secrets
Provider: AWS
Service: ssm
Severity: HIGH
Categories: secrets
Resource type: AwsSsmPatchCompliance

What this check verifies

AWS Systems Manager documents are inspected for embedded secrets within their content. Patterns resembling passwords, access keys, tokens, or private keys in document steps are flagged when values appear hardcoded rather than referenced securely.

Risk

Hardcoded secrets in SSM documents weaken CIA:

Confidentiality: readers of the document can exfiltrate credentials.
Integrity: stolen keys enable privilege escalation and automation tampering.
Availability: abused credentials can disrupt systems and impede recovery.

Recommendation

Avoid embedding secrets. Store them in Secrets Manager or Parameter Store as SecureString (KMS-encrypted) and reference at runtime. Apply least privilege to documents and secrets, prefer short-lived role credentials, rotate credentials, continuously scan/audit documents, and enforce separation of duties for authoring and approval.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ssm update-document —name <example_resource_name> —content file://<SANITIZED_DOCUMENT_FILE>.json

resource "aws_ssm_document" "<example_resource_name>" {
  name          = "<example_resource_name>"
  document_type = "Command"

  content = jsonencode({
    schemaVersion = "2.2"
    mainSteps = [{
      action = "aws:runShellScript"
      name   = "run"
      inputs = {
        runCommand = [
          // Critical: use ssm-secure dynamic reference to avoid hardcoded secrets
          "export PASSWORD='{{ssm-secure:/path/to/secret}}'"
        ]
      }
    }]
  })
}

Resources:
  <example_resource_name>:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Command
      Content:
        schemaVersion: '2.2'
        mainSteps:
          - action: aws:runShellScript
            inputs:
              runCommand:
                # Critical: reference a SecureString parameter instead of hardcoding a secret
                # This avoids embedding secrets in the document content
                - "export PASSWORD='{{ssm-secure:/path/to/secret}}'"

References

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ssm_document_secrets. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SQS queue has server-side encryption enabled SSM document is not shared publicly

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires