RISKS IN AWS SSM PORT FORWARDING

Summary from the TLDR Cybersecurity newsletter

AWS Systems Manager Session Manager (SSM) allows for IAM users to access EC2 instances. One common use case for this is port forwarding to other services such as RDS. The SSM-SessionManagerRunShell document may be implicitly granted to the user. This article details how to fix this.