Find Publicly Shared SSM Documents

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListDocuments",
      "Effect": "Allow",
      "Action": "ssm:ListDocuments",
      "Resource": "*"
    },
    {
      "Sid": "ReadDocumentsAndSharing",
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeDocumentPermission",
        "ssm:ListDocumentVersions",
        "ssm:GetDocument"
      ],
      "Resource": "arn:aws:ssm:*:111122223333:document/*"
    },
    {
      "Sid": "ReadBlockPublicSharingSetting",
      "Effect": "Allow",
      "Action": "ssm:GetServiceSetting",
      "Resource": "arn:aws:ssm:*:111122223333:servicesetting/ssm/documents/console/public-sharing-permission"
    },
    {
      "Sid": "FixOnlyWithApplyOrBlock",
      "Effect": "Allow",
      "Action": ["ssm:ModifyDocumentPermission", "ssm:UpdateServiceSetting"],
      "Resource": [
        "arn:aws:ssm:*:111122223333:document/*",
        "arn:aws:ssm:*:111122223333:servicesetting/ssm/documents/console/public-sharing-permission"
      ]
    }
  ]
}

// find-public-ssm-documents.ts
// Finds SSM documents you own that are shared publicly (account ID "all") or privately, scans every version of
// the public ones for secret-looking content without printing it, and reports the Region's block public
// sharing setting. --apply stops public sharing for the documents you name; --block turns on block public sharing.
// Usage:
//   npx tsx find-public-ssm-documents.ts [--region us-east-1]
//   npx tsx find-public-ssm-documents.ts --region us-east-1 --apply --names MyRunbook,MyPatchDoc [--block]
import {
  SSMClient,
  DescribeDocumentPermissionCommand,
  GetDocumentCommand,
  GetServiceSettingCommand,
  ModifyDocumentPermissionCommand,
  UpdateServiceSettingCommand,
  paginateListDocuments,
  paginateListDocumentVersions,
} from "@aws-sdk/client-ssm";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const region = flag("--region") ?? process.env.AWS_REGION ?? "us-east-1";
const apply = args.includes("--apply");
const block = args.includes("--block");
const toUnshare = (flag("--names") ?? "").split(",").map((n) => n.trim()).filter(Boolean);
const SETTING_ID = "/ssm/documents/console/public-sharing-permission";
const ssm = new SSMClient({ region });

const SECRET_HINTS: [RegExp, string][] = [
  [/\b(AKIA|ASIA)[A-Z0-9]{16}\b/, "AWS access key ID"],
  [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "private key block"],
  [/[a-z][a-z0-9+.-]*:\/\/[^\s:/@"]+:[^\s@"]+@/i, "URL with embedded password"],
  [/\b(ghp|gho|ghs|github_pat)_[A-Za-z0-9_]{20,}/, "GitHub token"],
  [/\bxox[abposr]-[A-Za-z0-9-]{10,}/, "Slack token"],
  [/(password|passwd|secret|api[_-]?key|token)\s*[=:]\s*['"]?[^\s'"{}$]{6,}/i, "hard-coded credential"],
];

interface Row {
  Document: string;
  Type: string;
  Sharing: string;
  Accounts: string;
  Versions: number;
  SecretHints: string;
}

const errText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

async function sharedWith(name: string): Promise<string[]> {
  const ids: string[] = [];
  let NextToken: string | undefined;
  do {
    const out = await ssm.send(new DescribeDocumentPermissionCommand({ Name: name, PermissionType: "Share", NextToken }));
    ids.push(...(out.AccountIds ?? []));
    NextToken = out.NextToken;
  } while (NextToken);
  return ids;
}

// Reads every version of a document and returns the kinds of secret found. Content is never printed.
async function scanVersions(name: string): Promise<{ versions: number; hints: string[] }> {
  const hints = new Set<string>();
  let versions = 0;
  for await (const page of paginateListDocumentVersions({ client: ssm }, { Name: name })) {
    for (const v of page.DocumentVersions ?? []) {
      versions++;
      const doc = await ssm.send(new GetDocumentCommand({ Name: name, DocumentVersion: v.DocumentVersion }));
      const content = doc.Content ?? "";
      for (const [re, label] of SECRET_HINTS) if (re.test(content)) hints.add(`${label} (v${v.DocumentVersion})`);
    }
  }
  return { versions, hints: [...hints] };
}

async function main(): Promise<void> {
  const setting = await ssm.send(new GetServiceSettingCommand({ SettingId: SETTING_ID }));
  const value = setting.ServiceSetting?.SettingValue ?? "unknown";
  console.log(`Block public sharing in ${region}: ${value === "Disable" ? "ON (public sharing blocked)" : `OFF (setting value ${value})`}`);

  const rows: Row[] = [];
  const owned: string[] = [];
  for await (const page of paginateListDocuments({ client: ssm }, { Filters: [{ Key: "Owner", Values: ["Self"] }] })) {
    for (const d of page.DocumentIdentifiers ?? []) {
      if (!d.Name) continue;
      owned.push(d.Name);
      const ids = await sharedWith(d.Name);
      if (!ids.length) continue;
      const isPublic = ids.some((id) => id.toLowerCase() === "all");
      const scan = isPublic ? await scanVersions(d.Name) : { versions: 0, hints: ["not scanned (private share)"] };
      rows.push({
        Document: d.Name,
        Type: d.DocumentType ?? "?",
        Sharing: isPublic ? "PUBLIC" : "private",
        Accounts: isPublic ? "everyone" : String(ids.length),
        Versions: scan.versions,
        SecretHints: scan.hints.join(", ") || "none found",
      });
    }
  }
  console.table(rows);
  const publicDocs = rows.filter((r) => r.Sharing === "PUBLIC").map((r) => r.Document);
  console.log(`${owned.length} documents owned in ${region}; ${publicDocs.length} public, ${rows.length - publicDocs.length} shared privately.`);

  if (!apply) {
    console.log("Report only: nothing was modified. Use --apply --names <a,b> to stop public sharing, --block to block it.");
    return;
  }
  for (const name of toUnshare) {
    if (!publicDocs.includes(name)) {
      console.error(`Skipping ${name}: not a public document you own in ${region}`);
      continue;
    }
    try {
      await ssm.send(new ModifyDocumentPermissionCommand({ Name: name, PermissionType: "Share", AccountIdsToRemove: ["all"] }));
      const left = await sharedWith(name);
      console.log(`Stopped public sharing of ${name}; remaining shares: ${left.length ? left.join(", ") : "none"}`);
    } catch (err) {
      console.error(`Could not update ${name}: ${errText(err)}`);
      process.exitCode = 1;
    }
  }
  if (block) {
    await ssm.send(new UpdateServiceSettingCommand({ SettingId: SETTING_ID, SettingValue: "Disable" }));
    console.log(`Block public sharing turned on in ${region}.`);
  }
}

main().catch((err) => {
  console.error(errText(err));
  process.exit(1);
});

npm install @aws-sdk/client-ssm
npm install --save-dev tsx typescript @types/node

# Report only
AWS_PROFILE=readonly npx tsx find-public-ssm-documents.ts --region us-east-1

# Stop public sharing of one document and block new public shares in this Region
AWS_PROFILE=ssm-admin npx tsx find-public-ssm-documents.ts --region us-east-1 \
  --apply --names Acme-InstallAgent --block

Block public sharing in us-east-1: OFF (setting value Enable)
┌─────────┬─────────────────────┬──────────────┬───────────┬────────────┬──────────┬───────────────────────────────┐
│ (index) │ Document            │ Type         │ Sharing   │ Accounts   │ Versions │ SecretHints                   │
├─────────┼─────────────────────┼──────────────┼───────────┼────────────┼──────────┼───────────────────────────────┤
│ 0       │ 'Acme-InstallAgent' │ 'Command'    │ 'PUBLIC'  │ 'everyone' │ 2        │ 'hard-coded credential (v1)'  │
│ 1       │ 'Acme-RotateLogs'   │ 'Automation' │ 'PUBLIC'  │ 'everyone' │ 1        │ 'none found'                  │
│ 2       │ 'Acme-Private'      │ 'Command'    │ 'private' │ '2'        │ 0        │ 'not scanned (private share)' │
└─────────┴─────────────────────┴──────────────┴───────────┴────────────┴──────────┴───────────────────────────────┘
4 documents owned in us-east-1; 2 public, 1 shared privately.
Stopped public sharing of Acme-InstallAgent; remaining shares: none
Block public sharing turned on in us-east-1.