All checks
Critical
SSM documents should not be public
Flags account-owned SSM documents that are publicly shared, which may expose sensitive configuration information.
- service
- SSM
- severity
- Critical
- scope
- evaluated in every region
How to fix it
Remove All from the named document's sharing list, leaving it shared with no one or only with the account IDs you intend. All is what makes a document readable by every AWS account, and it is what this check reads: the document's own sharing list, not its type. Removing All leaves any named accounts in place. The account-level block for public sharing (SSM.7) stops the next document being shared publicly and does not unshare this one, so both have to be done.
In the console
Systems Manager → Documents → the document → Permissions
With the AWS CLI
aws ssm modify-document-permission --name <document-name> --permission-type Share --account-ids-to-remove All --region <region>See which of your accounts this check is failing on.
Book a demo