aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::SSM::ServiceSetting] - [Coverage] - Missing resource for FSBP SSM.7

Open
#2,459 2 comments 4 reactions 0 assignees View on GitHub
Coverage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

_
### Resource name

AWS::SSM::ServiceSetting

### Description

I am requesting CloudFormation support for the `AWS::SSM::ServiceSetting` resource.

Specifically, I need to manage the **Block Public Sharing** setting for SSM documents to comply with the AWS Security Hub control **[[SSM.7]](https://docs.aws.amazon.com/securityhub/latest/userguide/ssm-controls.html#ssm-7)**.
To satisfy this control, the service setting `arn:aws:ssm:::servicesetting/ssm/documents/console/public-sharing-permission` must be set to `Disable`.

Currently, there is no native CFn resource to manage this configuration, forcing us to rely on Custom Resources or manual CLI commands (`aws ssm update-service-setting`).

#### Example

```yaml
Type: AWS::SSM::ServiceSetting
Properties:
SettingId: /ssm/documents/console/public-sharing-permission
SettingValue: Disable
```

### Other Details

- Security Hub Control: [[SSM.7]](https://docs.aws.amazon.com/securityhub/latest/userguide/ssm-controls.html#ssm-7) [SSM documents should have the block public sharing setting enabled](https://docs.aws.amazon.com/securityhub/latest/userguide/ssm-controls.html#ssm-7)
- AWS CLI: [update-service-setting](https://docs.aws.amazon.com/cli/latest/reference/ssm/update-service-setting.html)
- Terraform Equivalent: [aws_ssm_service_setting](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_service_setting)

Contributor guide

Open the contributing guide

Research direction

Start with the requested AWS::SSM::ServiceSetting resource and the linked AWS CLI update-service-setting and Terraform aws_ssm_service_setting documentation. Confirm the SettingId and SettingValue behavior for the Block Public Sharing setting; done means CloudFormation can declaratively manage this configuration for the SSM.7 control.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.