No identity-based policy allows the ssm:SendCommand action

Question

Hello there,
I have a Lambda that is trying to move a file from S3 to a Windows EC2 instance. I am using `ssm` to do it. When I get granular with the perms I get the following error:
```
2022-04-19T20:32:15.502Z	5737b35c-6d81-471f-b29c-3fd23f1a5123	INFO	AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/userxyz is not authorized to perform: ssm:SendCommand on resource: arn:aws:ssm:us-east-1::document/AWS-RunPowerShellScript because no identity-based policy allows the ssm:SendCommand action
```

If I attached the `AmazonSSMFullAccess` policy to the IAM Role, it works. Which other perm do I need to add so that I do not grant the very permissible managed policy?

_Edit:_ Forgot to attach the policy

```
 {
            "Effect": "Allow",
            "Action": "ssm:SendCommand",
            "Resource": [
                "arn:aws:ssm:*:xxx:document/*",
                "arn:aws:ec2:*:xxx:instance/*"
            ]
        }
```

Answer

What does your Lambda role's policy look like?  As per https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html there is an ssm:SendCommand policy action that can be applied to * or to specific resources including document which is a required resource type.  Are you missing this in your policy?

Answer

Turned out to be a silly mistake. I was adding the `{AWS::AccountId}` to the `document` resource. It did not need it
```
 Resource:
              - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:document/AWS-RunPowerShellScript"
```

Should have been
```
 Resource:
              - !Sub "arn:aws:ssm:${AWS::Region}::document/AWS-RunPowerShellScript"
```

Answer

In addition to ssm:SendMessage you will also need add another policy statement for *ssmmessages*

```
{
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:CreateControlChannel"
            ],
            "Resource": "*"
}
```
The SSM Messages endpoint is used for API operations with Systems Manager.

No identity-based policy allows the ssm:SendCommand action

Relevanter Inhalt