SSM organisation wide

For enabling AWS Systems Manager (SSM) session login across an organization with multiple accounts and regions, there are several approaches you can take:

1. AWS Systems Manager Quick Setup: This is the recommended approach for enterprise customers. Quick Setup can be deployed programmatically across your AWS Organization using AWS CLI or CloudFormation templates. It offers three key configurations:

• Default Host Management Configuration: Ensures SSM Agent is kept up-to-date on all EC2 instances and enables them to connect to Systems Manager
• Host Management best practices: Enables Inventory metadata collection
• Patch Manager organization patching configuration: Enables scheduled patch operations

2. Automation for unmanaged instances: For existing EC2 instances that aren't yet managed by Systems Manager, you can use AWS CloudFormation with StackSets to deploy the necessary resources across your organization. This approach uses Systems Manager Automation runbooks to install the SSM agent on unmanaged instances.

3. Central management approach: You can aggregate data about Systems Manager managed instances from multiple accounts/regions into a central location (S3 bucket or Explorer). This allows you to manage all instances from a single account.

For implementing IAM policies to control access to SSM sessions, you'll need to ensure your policies include permissions for both the EC2 instances and the SSM document (SSM-SessionManagerRunShell). A common issue when setting up cross-account access is forgetting to include permissions for the SSM document.

While you mentioned CloudFormation isn't supported, CloudFormation StackSets are actually a key component of deploying SSM at scale across an organization. Quick Setup itself uses CloudFormation StackSets under the hood to deploy configurations across your organization.
Sources
How to enable AWS Systems Manager for Multi Account and Multi Region | AWS re:Post
Deploy AWS Systems Manager Quick Setup programmatically across your AWS Organization | AWS Cloud Operations Blog
Automate installing AWS Systems Manager agent on unmanaged Amazon EC2 nodes | AWS Cloud Operations Blog
Based in the control access using SSM Police, Why this police don't work? | AWS re:Post