IAM Resource ARN for SSM

Question

I created an IAM policy to allow starting an SSM session to an EC2 instance. Initially, I specified **arn:aws:ssm::
/AWS-StartPortForwardingSession,** but it didn't work. I suspect this is because AWS-StartPortForwardingSession is an AWS-managed document. So, I modified it to **arn:aws:ssm:::/AWS-StartPortForwardingSession**.

I'm curious about the difference between arn:aws:ssm::*
/AWS-StartPortForwardingSession and arn:aws:ssm:::document/AWS-StartPortForwardingSession.

Why is the account ID sometimes omitted and other times replaced with an asterisk (*)?

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ssm:*::document/SSM-SessionManagerRunShell",
                "arn:aws:ssm:*::document/AWS-StartPortForwardingSession"
            ],
            "Condition": {
                "BoolIfExists": {
                    "ssm:SessionDocumentAccessCheck": "true" 
                }
            }
        }
]
}

Riku_Kobayashi · Accepted Answer

Hello.

For SSM documents managed by AWS, do not include the account ID.  
In other words, "AWS-StartPortForwardingSession" is a document managed by AWS, so there is no need to enter the account ID.  
I think the reason for the asterisk is to allow you to use SSM documents from all regions.  
https://docs.aws.amazon.com/systems-manager/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies  
> Documents and automation definition resources that are owned by Amazon, as well as public parameters that are provided by both Amazon and third-party sources, do not include account IDs in their ARN formats. For example:  
> * The SSM document AWS-RunPatchBaseline:  
>   * arn:aws:ssm:us-east-2::document/AWS-RunPatchBaseline  
> * The automation runbook AWS-ConfigureMaintenanceWindows:  
>   * arn:aws:ssm:us-east-2::automation-definition/AWS-ConfigureMaintenanceWindows  
> * The public parameter /aws/service/bottlerocket/aws-ecs-1-nvidia/x86_64/1.13.4/image_version:  
>   * arn:aws:ssm:us-east-2::parameter/aws/service/bottlerocket/aws-ecs-1-nvidia/x86_64/1.13.4/image_version

IAM Resource ARN for SSM

Relevant content