An SSM document is an AWS Systems Manager document that defines automation, configuration, or operational commands. It can describe tasks such as running scripts, patching instances, collecting data, or orchestrating maintenance workflows across EC2 and other managed systems.
In security, SSM documents matter because they can expose how an environment is administered and, if misconfigured, may be shared more broadly than intended. Attackers look for public or over-permissioned documents to learn operational procedures, discover command sequences, or abuse trusted automation paths. Defenders should treat them as sensitive infrastructure assets: restrict who can create and share them, review document contents for secrets or risky commands, and monitor for permission changes. Strong access control helps prevent a routine automation artifact from becoming a source of reconnaissance or unauthorized execution.