SSM document is not shared publicly

Check ID: ssm_documents_set_as_public
Provider: AWS
Service: ssm
Severity: HIGH
Categories: identity-access, internet-exposed
Resource type: AwsSsmPatchCompliance

What this check verifies

SSM documents are evaluated for public sharing (all) and for shares with AWS accounts outside a defined trusted list. Documents that remain private or are shared only with trusted accounts indicate restricted distribution.

Risk

Public or non-trusted sharing exposes document content, eroding confidentiality of scripts, parameters, and embedded secrets. Adversaries can study runbooks to craft targeted attacks and reuse logic, causing credential leakage and downstream integrity and availability impacts.

Recommendation

Apply least privilege to document distribution:

Keep documents private; share only with specific trusted account IDs
Enable account-level block public sharing for documents
Remove secrets from content; use secure parameters
Limit who can share or run documents; require reviews and version control

Remediation

CLI
Terraform
Dashboard steps

aws ssm modify-document-permission —name <DOCUMENT_NAME> —permission-type Share —account-ids-to-remove all

resource "aws_ssm_document" "<example_resource_name>" {
  name          = "<example_resource_name>"
  document_type = "Command"
  content       = jsonencode({
    schemaVersion = "2.2"
    mainSteps     = []
  })
  # Critical: no permissions block -> document remains private (not public/shared)
}

References

https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-before-you-share.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ssm_documents_set_as_public. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SSM document contains no secrets EC2 managed instance is compliant with SSM patching

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires