Access denied reading SSM parameter even though role has attached policy

Question

I am attempting to read an SSM parameter from the browser. Using the JavaScript AWS SDK I create a new SSMClient 
```
const ssmClient = new SSMClient({
    region: "us-west-2",
    credentials: fromCognitoIdentityPool({
      clientConfig: { region: "us-west-2" },
      identityPoolId: "us-west-2:xxxxx...",
    }),
  });
```

and then send a GetParameterCommand:

```
await ssmClient.send(
    new GetParameterCommand({
      Name: "{arn of Parameter}"
    })
  )
```
The identity pool provides a guest role that has the SSMReadOnly permission:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:Describe*",
                "ssm:Get*",
                "ssm:List*"
            ],
            "Resource": "*"
        }
    ]
}
```
so it should be able to perform ssm:GetParameter. However when I run this in the browser, I get the error:

```
AccessDeniedException: User: arn:aws:sts::{aws account id}:assumed-role/{role}/CognitoIdentityCredentials is not authorized to perform: ssm:GetParameter on resource: {arn of Parameter} because no session policy allows the ssm:GetParameter action
```
I also tried a policy statement with no wildcards, i.e. the only action was ssm:GetParameter and Resource was the specific ARN of my parameter. Is there something I'm missing in terms of configuring permissions? For reference, I was able to use a similar pattern of Identity Pool providing a role to Dynamo Read-only permissions in the same application. I also confirmed I can read the parameter in the IAM Policy Simulator.

Praveen Muppala(AWS) · Answer

It sounds like you're encountering an issue with session policies and the permissions assigned to the role assumed via Cognito. Here are a few steps and considerations to help resolve this issue:

**Ensure Role Trust Relationship: **Ensure that the Cognito Identity Pool role has a trust relationship allowing Cognito to assume the role. The trust relationship policy should look like this:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "us-west-2:xxxxx..."
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "unauthenticated"
        }
      }
    }
  ]
}
```
**Check KMS Key Permissions:** If your SSM Parameter Store is using a KMS key for data encryption, ensure that your Cognito role has the necessary permissions to access the KMS key for decryption. The KMS Key policy should include:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms: GenerateDataKey",
      ],
      "Resource": "arn:aws:kms:us-west-2:{account-id}:key/{key-id}"
    }
  ]
}

Access denied reading SSM parameter even though role has attached policy

Add your answer

Relevant content