How do I configure Run Command to send output to an Amazon S3 bucket in another AWS account?

Short description

You can use Run Command to run Systems Manager documents, such as AWS-RunPatchBaseline and AWS-RunPowerShellScript, in managed instances. Then, you can send the output to Amazon CloudWatch and Amazon S3 in the same account, or to an S3 bucket in another account.
To allow Systems Manager to access an S3 bucket in another account, configure the following AWS Identity and Access Management (IAM) and bucket policies.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Resolution

Permissions for IAM instance profile

An instance profile is a container that passes IAM role information to an Amazon Elastic Compute Cloud (Amazon EC2) instance at launch. The IAM role that’s attached to your managed Amazon EC2 instance must have the following actions in place to allow access to the S3 bucket:

{
 "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"
    }
  ]
}

Note: Replace amzn-s3-demo-bucket with the S3 bucket name in the target account.

For more information about the S3 permissions required for specific scenarios, see Create a custom policy for S3 bucket access.

Target S3 bucket policy

The target S3 bucket must allow the instance profile role that's attached to the managed EC2 instance to access the bucket. You can either create a bucket policy or grant access to the source account in bucket access control list (ACL).

Warning: It's a security best practice to create a bucket policy. When you add the source account to the bucket ACL, the bucket policy allows all users and roles in the source account to access the S3 bucket.

The following is an example bucket policy for the target S3 bucket:

{
 "Version": "2012-10-17",
  "Id": "Policy1589684413780",
  "Statement": [
    {
      "Sid": "Stmt1589684412557",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::SOURCE-AWS-ACCOUNT:role/INSTANCE-PROFILE-ROLE-NAME"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"
    }
  ]
}

Note: Replace amzn-s3-demo-bucket with the S3 bucket name in the target account. Replace SOURCE-AWS-ACCOUNT with the source account ID. Replace INSTANCE-PROFILE-ROLE-NAME with the IAM role name that is attached to the EC2 instance.

Configure Run Command to send the command output to Amazon S3

To configure Run Command in the Systems Manager console, complete the following steps:

1. Open the Systems Manager console, and then choose Run Command from the navigation pane.
2. Choose Run command.
3. Select the document that you want to run, and enter all required parameters.
4. For Output Options, select Enable an S3 bucket. Choose Enter an S3 bucket name in the text box, and then enter the name of the S3 bucket in the target account.
5. (Optional) To send the command output to a subfolder of the S3 bucket, for S3 key prefix, enter the S3 key prefix.

To use the AWS CLI to configure Run Command, when you run a SendCommand API call, add the following parameters to specify the output options:

`--output-s3-bucket-name "amzn-s3-demo-bucket" `  
`--output-s3-key-prefix "amzn-s3-demo-bucket-PREFIX"`

Note: In the preceding parameter examples, amzn-s3-demo-bucket is the name of the S3 bucket in your target account. amzn-s3-demo-bucket-PREFIX indicates the subfolder within the S3 bucket where you want to store the response. The output-s3-key-prefix parameter isn't required to send the command output to an S3 bucket. For more information, see send-command.

The following AWS CLI example initiates a command that uses the AWS-RunPowerShellScript document to remotely run echo helloWorld in the managed instances tagged as Key=tag:Env,Values=Dev,Test. The command output is sent to the S3 bucket named amzn-s3-demo-bucket in your target account and stored in a subfolder with the prefix amzn-s3-demo-bucket-PREFIX.

aws ssm send-command --document-name "AWS-RunPowerShellScript" --parameters '{"commands":["echo helloWorld"]}'  --targets '[{"Key":"tag:Env","Values":["Dev","Test"]}]' --output-s3-bucket-name "amzn-s3-demo-bucket" --output-s3-key-prefix "amzn-s3-demo-bucket-PREFIX"

Related information

Configure instance permissions required for Systems Manager