...
The IAM Role Edit page will be shown with the Permissions Policies listed.
Note: The following policies listed are required in order for SSM to function properly.
- AmazonSSMManagedInstanceCore: https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAmazonSSMManagedInstanceCore
- CloudWatchAgentServerPolicy: https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FCloudWatchAgentServerPolicy
- AmazonSSMFullAccess: https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAmazonSSMFullAccessAmazonSSMFullAccess
- (Optional - Includes all possible permissions. Not recommended for least privilege
- )
To view more detailed information about each Permissions Policy, use the link next to each Policy to display the JSON definition.
Recommendations
Use the AmazonSSMManagedInstanceCore managed policy for the minimum required permissions. Add additional permissions based on your use case (e.g., Session Manager, Patch Manager). Follow the principle of least privilege to restrict permissions to only what is necessary.
...