"ValidationException: The assume role is invalid" while creating Association


It show this error "ValidationException: The assume role is invalid" while creating Association with the document "AWSEC2-PatchLoadBalancerInstance". It say to use "AWSServiceRoleForAmazonSSM" but it can be added as the association role

The assume role is invalid

1 Answer


This seems to be a limitation with the document "AWSEC2-PatchLoadBalancerInstance". A possible workaround for this would be to clone the document and provide an assume role manually within the automation document itself. Please follow below steps for the same -

  1. Go to AWS Systems Manager service --> Documents
  2. Search and select the document "AWSEC2-PatchLoadBalancerInstance"
  3. Click on Actions --> Clone document
  4. Under the field 'Assume Role - optional', provide the ARN of the Role 'AWSServiceRoleForAmazonSSM' and click on Create Automation at the bottom of the screen
  5. Use this cloned copy to create SSM association

Alternatively, you can use AWS Maintenance Windows to patch your LB instances using the document 'AWSEC2-PatchLoadBalancerInstance'.

Hope this helps!

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions