Adding Session Manager permissions to an existing IAM role
Follow these steps to embed Session Manager permissions in an existing AWS Identity and Access Management
(IAM) role that doesn't rely on the AWS-provided default policy
AmazonSSMManagedInstanceCore
for instance permissions. This
procedure assumes that your existing role already includes other Systems Manager
ssm
permissions for actions you want to allow access to. This
policy alone isn't enough to use Session Manager.
To add Session Manager permissions to an existing role (console)
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/
. -
In the navigation pane, choose Roles.
-
Choose the name of the role to embed a policy in.
-
Choose the Permissions tab.
-
Choose Add inline policy. The link is located on the right side of the page.
-
Choose the JSON tab.
-
Replace the default content with the following policy. Replace
key-name
with the Amazon Resource Name (ARN) of the KMS key you want to use.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "
key-name
" } ] }For information about using a KMS key to encrypt session data, see Turn on KMS key encryption of session data (console).
If you won't use AWS KMS encryption for your session data, you can remove the following content from the policy.
, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "
key-name
" } -
Choose Next: Tags.
-
(Optional) Add tags by choosing Add tag, and entering the preferred tags for the policy.
-
Choose Next: Review.
-
On the Review policy page, for Name, enter a name for the inline policy, such as
SessionManagerPermissions
. -
(Optional) For Description, enter a description for the policy.
Choose Create policy.
For information about the ssmmessages
actions, see Reference: ec2messages,
ssmmessages, and other API operations.