AWS SSM can't ping to my ec2 instance

Question

i have 2 ec2 instance, and one of them can't remote using ssm fleet manager.  i tried to reinstall the agent but it's still doesn't work. Default Host Management Configuration is already configured with the *AWSSystems ManagerDefaultEC2instanceManagementRole (recommended).*

here's the logs that i've gathered from the ssm

```
2023-11-26 20:15:58 INFO [ssm-agent-worker] [MessageService] [MDSInteractor] increasing error count by 1
2023-11-26 20:16:01 ERROR EC2RoleProvider unable to load shared credentials. Err: shared credentials are already expired, they were retrieved at 2023-11-24T19:34:38Z and expired at 2023-11-24T20:29:38Z
2023-11-26 20:16:01 ERROR [ssm-agent-worker] [MessageService] [MDSInteractor] error when calling AWS APIs. error details - GetMessages Error: unable to load shared credentials. Err: shared credentials are already expired, they were retrieved at 2023-11-24T19:34:38Z and expired at 2023-11-24T20:29:38Z
2023-11-26 20:16:01 INFO [ssm-agent-worker] [MessageService] [MDSInteractor] increasing error count by 1
2023-11-26 20:16:03 ERROR EC2RoleProvider unable to load shared credentials. Err: shared credentials are already expired, they were retrieved at 2023-11-24T19:34:38Z and expired at 2023-11-24T20:29:38Z
```

any idea to fix this issue?

Accepted Answer

turns out there's a problem with the local time on the OS instances, i have to use Amazon Time Sync Service to sync up the time with it and it solves the problem.

Answer

Hi seargex,

The problem you are currently experiencing seems to be caused by the expiration of the IAM Role attached to EC2.

This problem will be resolved if you modify IAM Role which is attached to the instance.

- Modify IAM Role: EC2 > Choose EC2 Instance to modify > [Actions] > [Security] > "Modify IAM role"

You can refer to the document below for the required permissions:
    
[+] [Create an IAM Policy with Fleet Manager permissions](https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-setup-iam.html) (AWS Documentation)

Please refer to the case in Stack Overflow which includes an answer from AWS Support Team for S3 about a similar situation: 
[+] [stack-overflow aws credentials refreshed but still expired](https://stackoverflow.com/a/50881890)

---

FYI. You can also check the expiration of the credentials with the command below:
```
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` && curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/iam/security-credentials/]
```
[+] [Retrieve security credentials from instance metadata](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials)

---

If I have missed anything or answered wrong, please feel free to ask me again. Also you have any questions, comment please!

AWS SSM can't ping to my ec2 instance

関連するコンテンツ