Exact roles/permissions needed to export Patch? Unable to create “AWS-ExportPatchReportToS3l” error

To export a SSM Patch Manager compliance report to an S3 bucket, you need to have the following permissions:

1. S3 bucket permissions: You need to have write permissions to the S3 bucket where you want to export the patch report. Make sure that the bucket policy allows the AWS account that owns the instance to write to the bucket.
2. IAM permissions: You need to have IAM permissions to run the following AWS Systems Manager Automation document: "AWS-ExportPatchReportToS3". The required IAM permissions for this document are:

ssm:UpdateAssociationStatus
ssm:UpdateInstanceInformation
ssm:SendCommand
s3:PutObject

To create an IAM role with these permissions, you can use the AWS Systems Manager console, AWS CLI, or AWS SDKs. The role must have an inline policy with the above mentioned permissions. If you already have a role that has these permissions, then make sure that the role is assigned to the EC2 instances that you want to export the patch report from.

3. Patch Manager permissions: You must also have permissions to create a patch baseline and associate it with instances. This can be done by attaching the "AmazonSSMManagedInstanceCore" policy to the instance or by creating a custom policy that allows the required permissions.

Make sure that you have all of the above permissions in order to successfully export the patch report to S3.

The role "AWS-SystemsManager-PatchSummaryExportRole" is only automatically created when you use the GUI Console to first run the S3 export. If you first call it any other way (CLI, API, etc) nothing is created for you. It's part of a bit of (annoyingly) hidden magic the Console does on your behalf when you're using clickops to run things like this.

I found no documentation for what magic the Console does, so to build this reporting at scale I reverse engineered it. In the end you'll likely need not only the Role for the automation to use, but an additional role for EventBridge to be able to call the automation (via a schedule). The report also only queries the current account and region, so if you roll this out at scale it implies a Cloudformation StackSet to wrap it all up. But...you can't just run it everywhere because Roles are global.

The Cloudformation Stack attached below is intended for use alone or as deployed as a StackSet across any number of accounts and regions, so long as at least one of those regions matches the HomeRegionForRoles parameter. I use this parameter to ensure the required roles are only created once. Note that in this configuration the central bucket must have a bucket policy allowing all the source accounts to reach it, both s3:PutObject and s3:GetBucketAcl. I did this in my environment by using a bucket policy with a Conditional on the aws:PrincipalOrgID. -Note aws:SourceOrgID won't work here because the principle is actually your account, not the service. This stack does not create that bucket. In my environment I prebuilt that bucket in my Logs account.

Feel free to crib any or all of this for your own needs.

AWSTemplateFormatVersion: 2010-09-09
Description: Configure Patch Manager centralized reporting

Parameters:
  HomeRegionForRoles:
    Type: String
    Default: us-east-1

  BucketName:
    Type: String

Conditions:
  IsGlobalRegion: !Equals
    - !Ref AWS::Region
    - !Ref HomeRegionForRoles

Resources:
  AWSExportPatchReportToS3Role:
    Condition: IsGlobalRegion
    Type: AWS::IAM::Role
    Properties:
      RoleName: "AWSExportPatchReportToS3Role"
      Path: "/service-role/"
      Description: "Service role for lambda to execute csv export of patch reports"
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: "sts:AssumeRole"
            Principal:
              Service:
                - "ssm.amazonaws.com"
      Policies:
        - PolicyName: "SSM-Report-Permissions"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action: "s3:PutObject"
                Resource:
                  - !Sub "arn:aws:s3:::${BucketName}/*"
              - Effect: "Allow"
                Action: "s3:GetBucketAcl"
                Resource:
                  - !Sub "arn:aws:s3:::${BucketName}"
              - Effect: "Allow"
                Action:
                  - "ssm:DescribeInstancePatchStates"
                  - "ssm:DescribeInstancePatches"
                  - "ssm:ListComplianceItems"
                  - "ssm:ListResourceComplianceSummaries"
                  - "ssm:DescribeInstanceInformation"
                  - "ssm:GetInventory"
                  - "ec2:DescribeInstances"
                Resource: "*"

  DailyPatchEventBridgeSSMAutomationRole:
    Condition: IsGlobalRegion
    Type: AWS::IAM::Role
    Properties:
      RoleName: DailyPatchEventBridgeSSMAutomationRole
      Path: "/service-role/"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
      Description: Service role for event bridge to call ssm automation
      MaxSessionDuration: 3600
      Policies:
        - PolicyName: "SSM-Report-Permissions"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: ssm:StartAutomationExecution
                Resource:
                  - !Sub "arn:${AWS::Partition}:ssm:*:${AWS::AccountId}:automation-definition/AWS-ExportPatchReportToS3:$DEFAULT"
                  - !Sub "arn:${AWS::Partition}:ssm:*::automation-definition/AWS-ExportPatchReportToS3:$DEFAULT"
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource:
                  - !GetAtt AWSExportPatchReportToS3Role.Arn

  DailyPatchReport:
    Type: AWS::Events::Rule
    Properties:
      Description: "Schedule recurring patch reporting"
      ScheduleExpression: "rate(1 day)"
      State: ENABLED
      EventBusName: default
      Targets:
        - Id: "AWS-SystemsManager-PatchManager-PatchReport-Daily"
          Arn: !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:automation-definition/AWS-ExportPatchReportToS3:$DEFAULT"
          RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/service-role/DailyPatchEventBridgeSSMAutomationRole"
          Input: !Sub |
            {
              "assumeRole": [ "arn:aws:iam::${AWS::AccountId}:role/service-role/AWSExportPatchReportToS3Role" ],
              "reportName": [ "patch-summary_${AWS::AccountId}_${AWS::Region}" ],
              "s3BucketName": [ "${BucketName}" ],
              "targets": [ "instanceids=*" ]
            }