When I try to connect to EC2 with proper IAM role, the sessions manager gives error.

This error suggests that you're trying to use Session Manager with an incorrect document type. Session Manager only supports documents of type 'Session', but it appears you're attempting to use a document of type 'Command'.

To resolve this issue, check the following:

1. Make sure you're using the correct approach to start a session. When connecting through the AWS console, simply select the instance, choose "Connect," and then select "Session Manager" as the connection method.

2. If you're using the AWS CLI to connect, ensure you're using the correct command format. For Session Manager connections, use the start-session command rather than a Run Command operation.

3. Verify that the IAM role attached to your EC2 instances has the proper permissions. The role should include the AmazonSSMManagedInstanceCore managed policy or equivalent permissions that specifically allow Session Manager operations.

4. Ensure that the SSM Agent is installed and running on your EC2 instances. The agent must be version 2.3.68.0 or later to support Session Manager.

5. Check if there are any custom Session Manager configurations in the problematic AWS account that might be causing this issue, since you mentioned it only happens in one specific account within your organization.

6. If you're using a custom document for Session Manager, verify that it's properly configured as a Session type document.

Since this issue is isolated to one account in your AWS organization, it suggests there might be a configuration difference in that account compared to your other accounts. You might want to compare the Session Manager settings, IAM policies, and SSM Agent configurations between the accounts to identify the discrepancy.
Sources
Troubleshooting Session Manager - AWS Systems Manager
Unable to connect EC2 instance via Session Manager | AWS re:Post
Connect to your Amazon EC2 instance using Session Manager - Amazon Elastic Compute Cloud

The error means Session Manager trying to use a document of type "Command" instead of the required "Session" type.

To fix it:

• Ensure the default Session Manager document (AWS-StartSession) exists and is correct in the affected account.

• Avoid using custom "Command" type documents for sessions.

• Verify the IAM role has ssm:StartSession permission.

This usually resolves the issue when only one account is affected.