No identity-based policy allows the ssm:SendCommand action

Question

Hello there,
I have a Lambda that is trying to move a file from S3 to a Windows EC2 instance. I am using `ssm` to do it. When I get granular with the perms I get the following error:
```
2022-04-19T20:32:15.502Z	5737b35c-6d81-471f-b29c-3fd23f1a5123	INFO	AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/userxyz is not authorized to perform: ssm:SendCommand on resource: arn:aws:ssm:us-east-1::document/AWS-RunPowerShellScript because no identity-based policy allows the ssm:SendCommand action
```

If I attached the `AmazonSSMFullAccess` policy to the IAM Role, it works. Which other perm do I need to add so that I do not grant the very permissible managed policy?

_Edit:_ Forgot to attach the policy

```
 {
            "Effect": "Allow",
            "Action": "ssm:SendCommand",
            "Resource": [
                "arn:aws:ssm:*:xxx:document/*",
                "arn:aws:ec2:*:xxx:instance/*"
            ]
        }
```

Answer

Turned out to be a silly mistake. I was adding the `{AWS::AccountId}` to the `document` resource. It did not need it
```
 Resource:
              - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:document/AWS-RunPowerShellScript"
```

Should have been
```
 Resource:
              - !Sub "arn:aws:ssm:${AWS::Region}::document/AWS-RunPowerShellScript"
```

Answer

In addition to ssm:SendMessage you will also need add another policy statement for *ssmmessages*

```
{
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:CreateControlChannel"
            ],
            "Resource": "*"
}
```
The SSM Messages endpoint is used for API operations with Systems Manager.

Answer

What does your Lambda role's policy look like?  As per https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html there is an ssm:SendCommand policy action that can be applied to * or to specific resources including document which is a required resource type.  Are you missing this in your policy?

No identity-based policy allows the ssm:SendCommand action

Relevant questions

Cloudfront with a Lambda@Edge pointing to a private S3

Move Glacier data to Deep Glacier

Bucket Policy to Restrict Access to an Instance Profile

Downloaded files are corrupted when publishing on AWS lambda

Access Forbidden when accessing manifest.json from S3 Batch operation

Transfer Data from EC2 to S3

Windows Server RDP error

SSM Automation - Download file from S3 - Assume Role

No identity-based policy allows the ssm:SendCommand action

Unsupported Action in Policy for S3 Glacier/Veeam