AmazonEC2RoleforSSM
Description: This policy will soon be deprecated. Please use AmazonSSMManagedInstanceCore policy to enable AWS Systems Manager service core functionality on EC2 instances. For more information see https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-profile.html
AmazonEC2RoleforSSM
is an AWS managed policy.
Using this policy
You can attach AmazonEC2RoleforSSM
to your users, groups, and roles.
Policy details
-
Type: Service role policy
-
Creation time: May 29, 2015, 17:48 UTC
-
Edited time: January 24, 2019, 19:20 UTC
-
ARN:
arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
Policy version
Policy version: v8 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Action" : [ "ssm:DescribeAssociation", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:GetManifest", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssm:PutInventory", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "cloudwatch:PutMetricData" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "ec2:DescribeInstanceStatus" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "ds:CreateComputer", "ds:DescribeDirectories" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "s3:GetBucketLocation", "s3:PutObject", "s3:GetObject", "s3:GetEncryptionConfiguration", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:ListBucketMultipartUploads" ], "Resource" : "*" } ] }