Policy to restrict command and instance combinations

Question

Hi,  
  
we are looking at moving away from Rundeck to AWS Systems Manager, but we do not see how to restrict certain commands to certain instances. For example, in Rundeck we can allow Command1 to be sent to instances A or B and Command2 to be sent to instances B or C (but not A).  
  
We tried something like this in SSM, but the policies end up being additive and commands 1 & 2 can be executed on A, B, or C:

```
{
            "Action": [
                "ssm:SendCommand"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ec2:ca-central-1:*:instance/InstanceA",
                "arn:aws:ec2:ca-central-1:*:instance/InstanceB",
                "arn:aws:ssm:ca-central-1:*:document/Command1"
            ]
        },
{
            "Action": [
                "ssm:SendCommand"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ec2:ca-central-1:*:instance/InstanceB",
                "arn:aws:ec2:ca-central-1:*:instance/InstanceC",
                "arn:aws:ssm:ca-central-1:*:document/Command2"
            ]
        },
```

We then tried with conditions based on resource tag, but we can only filter instances OR commands, but not both at the same time.  
  
Any tip on how to do this?  
  
Regards,  
Bart

Answer

Thanks for reaching out.   
  
RunCommand supports conditions on a specific resource, however, combinations of different resources are not supported.   
  
A workaround is to create different policies for different users, one is to allow Command1 to be sent to instances A or B, the other one is to allow Command2 to be sent to instances B or C.   
  
Thanks!

Policy to restrict command and instance combinations

Relevant content