Feature Request: Server side remote & document execution restriction

For all kind of limitation, IAM policies are used to restrict Document execution through ssm-agent. I would like to add an extra security layer at the agent side to avoid execution of unauthorized Documents. Even if an user uses System Manager SendCommand to execute a Document that is not in the agent white-list, the agent will reject this job or return a failed status.

As an acceptance criteria: A IAM root or power user won't be able to execute any other Documents than those declared in the whitelist at the agent side.

Thanks for your feedback on this feature request.

The issue names no files, tests, or entry points. Start by locating the agent's Document execution path and how an agent-side whitelist could be configured; done means unauthorized Documents are rejected or reported failed, including attempts by IAM root or power users.

Written by the indexing model from the issue text.