SSM Association Role

I believe your question is more towards, what are the permissions required for running SSM start-associations-once.

Please refer Actions, resources, and condition keys for AWS Systems Manager and search for startassociation in this page, you'll see what are the permissions and resource access are required. Basically, your CLI user must have StartAssociationsOnce for the resource arn:aws:ssm:*:<AccountId>:association/<SSM_ResourceName>. SSMResourceName can be "*" as well if you want to give access for all resources.

Hope this helps.

Comment here if you have additional questions, happy to help.

Abhishek