All checks
Critical
SSM documents should not be public
Checks whether an SSM document this account owns is shared with All, which makes it readable by every AWS account and can expose information about your account, resources and internal processes. The Region's block public sharing setting (SSM.7) stops new public shares but does not unshare this document.
- service
- SSM
- severity
- Critical
- scope
- evaluated in every region
How to fix it
- Can break clients: Every other account loses access to the document once All is removed, so share it privately, by account ID or AWS RAM, with any that still need it.
In the console
Systems Manager → Documents → the document → Permissions
- Private
- Selected, adding only the account IDs that still need this document, or none
With the AWS CLI
aws ssm modify-document-permission --name <document-name> --permission-type Share --account-ids-to-remove All --region <region>See which of your accounts this check is failing on.
Book a live scan