By using AWS re:Post, you agree to the Terms of Use
/No identity-based policy allows the ssm:SendCommand action/

No identity-based policy allows the ssm:SendCommand action

0

Hello there, I have a Lambda that is trying to move a file from S3 to a Windows EC2 instance. I am using ssm to do it. When I get granular with the perms I get the following error:

2022-04-19T20:32:15.502Z	5737b35c-6d81-471f-b29c-3fd23f1a5123	INFO	AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/userxyz is not authorized to perform: ssm:SendCommand on resource: arn:aws:ssm:us-east-1::document/AWS-RunPowerShellScript because no identity-based policy allows the ssm:SendCommand action

If I attached the AmazonSSMFullAccess policy to the IAM Role, it works. Which other perm do I need to add so that I do not grant the very permissible managed policy?

Edit: Forgot to attach the policy

 {
            "Effect": "Allow",
            "Action": "ssm:SendCommand",
            "Resource": [
                "arn:aws:ssm:*:xxx:document/*",
                "arn:aws:ec2:*:xxx:instance/*"
            ]
        }
3 Answers
0

What does your Lambda role's policy look like? As per https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html there is an ssm:SendCommand policy action that can be applied to * or to specific resources including document which is a required resource type. Are you missing this in your policy?

answered a month ago
  • duh! I thought I had posted the Policy as well. Updated the post to include it.

0

In addition to ssm:SendMessage you will also need add another policy statement for ssmmessages

{
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:CreateControlChannel"
            ],
            "Resource": "*"
}

The SSM Messages endpoint is used for API operations with Systems Manager.

answered a month ago
  • I tried this too and it did not help. Get the following error:

    AccessDeniedException: User: arn:aws:sts::xxxx:assumed-role/abc/xyz is not authorized to perform: ssm:SendCommand on resource: arn:aws:ssm:us-east-1::document/AWS-RunPowerShellScript because no identity-based policy allows the ssm:SendCommand action
0

Turned out to be a silly mistake. I was adding the {AWS::AccountId} to the document resource. It did not need it

 Resource:
              - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:document/AWS-RunPowerShellScript"

Should have been

 Resource:
              - !Sub "arn:aws:ssm:${AWS::Region}::document/AWS-RunPowerShellScript"
answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions