"ValidationException: The assume role is invalid" while creating Association

Hello,

This seems to be a limitation with the document "AWSEC2-PatchLoadBalancerInstance". A possible workaround for this would be to clone the document and provide an assume role manually within the automation document itself. Please follow below steps for the same -

1. Go to AWS Systems Manager service --> Documents
2. Search and select the document "AWSEC2-PatchLoadBalancerInstance"
3. Click on Actions --> Clone document
4. Under the field 'Assume Role - optional', provide the ARN of the Role 'AWSServiceRoleForAmazonSSM' and click on Create Automation at the bottom of the screen
5. Use this cloned copy to create SSM association

Alternatively, you can use AWS Maintenance Windows to patch your LB instances using the document 'AWSEC2-PatchLoadBalancerInstance'.

Hope this helps!