This document will provide detailed instructions and a step-by-step process to configure your EC2 instances appropriately to have a functioning Systems Manager (SSM) agent. To enable SSM, you must configure a custom IAM Role and include the requisite AWS Permissions Policies in order for the SSM agent to function properly. Descriptions of these underlying policies as well as the steps for using them are included below.

Requirements
- AWS Console Access with elevated privileges
- Access to create a custom IAM Role for your specific project and region
- Sufficient space on the attached EBS volume to allow the SSM agent to operate properly

Instructions - Overview
1) Determine if your EC2 has an IAM Role attached
2) Create a custom IAM Role
3) Attach the IAM Role to EC2 instance
3) Review underlying Permissions Policies

Instructions - Detailed

1) Determine IAM Role Status
Using the AWS Console, navigate to the EC2 Instance Summary page. You can do this by entering "EC2" in the search box at top of the console, and then selecting the ID for one of your instances.  Once there, the IAM Role will be shown at the bottom left of the Instance Summary page. If IAM Role is blank, follow the Attach IAM Role instructions to attach a custom role to your instance.

 

2) Create New IAM Role
On the EC2 Instance summary page, use the Actions->Security menu at the upper right and choose Modify IAM Role. This will display the Modify IAM Role page where you'll be able to choose the Permissions Policies for your instance.

3) Attach IAM Role
On the EC2 Instance summary page, use the Actions->Security menu at the upper right and choose Modify IAM Role.

This will display the Modify IAM Role page where you'll be able to choose a role to attach to your instance.

From the IAM Role dropdown, choose the custom role you created, and then select the Update IAM role button to save the changes.

The EC2 Instance Summary page will be re-displayed with the newly selected IAM role shown, along with a confirmation message about the changes.

4) Review Permissions Policies
To view the underlying Permissions Policies that are required in your custom IAM Role, click on the link on the EC2 Instance summary page. 

The IAM role will be displayed with the selected AWS Permissions Policies shown. Note: The policies listed are required in order for SSM to function properly.
AmazonSSMManagedInstanceCore
CloudWatchAgentServerPolicy
AmazonSSMFullAccess (Optional - Includes all possible permissions. Not recommended for least privilege.)
To view more detailed information about each Permissions Policy, use the link next to each Policy to display the JSON definition.

Recommendations
Use the AmazonSSMManagedInstanceCore managed policy for the minimum required permissions. Add additional permissions based on your use case (e.g., Session Manager, Patch Manager). Follow the principle of least privilege to restrict permissions to only what is necessary.