Newbie question on SSM setup and running admin commands on EC2 instance from personal laptop

Question

I am getting started with boto3 python library and AWS and want to send SSM commands to an EC2 Ubuntu Linux instance started from python code-standard AWS AMI ami-0c55b159cbfafe1f0.

However  the service I start fails to register with SSM after many tries ( code gist below) . I have tried to add all requisite permissions. I feel the solution is at the intersection of SSM setup and my IAM roles. I dont have cloudwatch enabled on the instance and cant access any logs as far as I know

The error I get from boto3 is :

```
Waiting for instance i-085d75e4bbd62f4f6 to register with SSM...
Waiting for instance i-085d75e4bbd62f4f6 to register with SSM...
Waiting for instance i-085d75e4bbd62f4f6 to register with SSM...
Waiting for instance i-085d75e4bbd62f4f6 to register with SSM...
Traceback (most recent call last):
  File "/Users/harijayaram/hjworkbench/ec2_parallel_download/ec2_parallel_download/unit_operations.py", line 171, in 
    main()
  File "/Users/harijayaram/hjworkbench/ec2_parallel_download/ec2_parallel_download/unit_operations.py", line 167, in main
    command_id = send_ssm_command(instance_id, commands, AWS_REGION)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/harijayaram/hjworkbench/ec2_parallel_download/ec2_parallel_download/unit_operations.py", line 110, in send_ssm_command
    raise Exception("Instance failed to register with SSM")
Exception: Instance failed to register with SSM
Instance i-085d75e4bbd62f4f6 failed to register with SSM after 30 attempts
```

Here are the relevant IAM details:

My user has access to the following
AmazonEC2FullAccess
AmazonSSMFullAccess
AmazonSSMManagedInstanceCore
AmazonS3FullAccess

In addition the user has an SSM send policy ( suggested by AWS uspport) attached :
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": "ssm:SendCommand",
            "Resource": "*"
        }
    ]
}

The code I use to start my instance is fairly straightforward and is on the gist :[https://gist.github.com/harijay/319cd1e6c5dc3f8bffeccee16bc9cdf0](https://gist.github.com/harijay/319cd1e6c5dc3f8bffeccee16bc9cdf0)

I feel I am having an issue with my permissions which is preventing the instance from getting  registered with SSM.
Hari

Mrityunjay Singh · Accepted Answer

This could be due to several reasons, such as network connectivity issues, incorrect IAM permissions, or problems with the SSM Agent installation.

Verify network connectivity : Make sure that the instance's security group allows outbound connections to the required SSM endpoints. If the instance is in a private subnet, you may need to set up a VPC endpoint for SSM. refer (https://repost.aws/questions/QUCuCl8hlTR_Sdnn7GrGsr4w/ssm-agent-is-not-online-the-ssm-agent-was-unable-to-connect-to-a-systems-manager-endpoint-to-register-itself-with-the-service).

Inspect SSM Agent logs : Connect to the instance and check the SSM Agent logs located at 
/var/log/amazon/ssm/amazon-ssm-agent.log
 for any error messages or clues about the registration failure.

Reinstall SSM Agent : If the logs don't provide any helpful information, try reinstalling the SSM Agent on the instance. You can follow the instructions in the AWS documentation for your specific operating system: https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html

The AmazonSSMFullAccess policy provides comprehensive permissions for all SSM actions, including the ability to send commands to managed instances. The AmazonSSMManagedInstanceCore policy allows the instance to register with SSM and process requests from the service.
The additional SSM send policy you've attached is not necessary since the AmazonSSMFullAccess policy already includes the ssm:SendCommand permission. However, having this additional policy won't cause any issues.

Newbie question on SSM setup and running admin commands on EC2 instance from personal laptop

Add your answer

Relevant content