Adding Session Manager permissions to an existing instance profile

Follow these steps to embed Session Manager permissions in an existing AWS Identity and Access Management (IAM) instance profile that doesn't rely on the AWS-provided default policy AmazonSSMManagedInstanceCore for instance permissions. This procedure assumes that your existing profile already includes other Systems Manager ssm permissions for actions you want to allow access to. This policy alone isn't enough to use Session Manager.

To add Session Manager permissions to an existing instance profile (console)

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Roles.

3. Choose the name of the role to embed a policy in.

4. Choose the Permissions tab.

5. Choose Add inline policy.

6. Choose the JSON tab.

7. Replace the default content with the following:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ssmmessages:CreateControlChannel",
                   "ssmmessages:CreateDataChannel",
                   "ssmmessages:OpenControlChannel",
                   "ssmmessages:OpenDataChannel"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetEncryptionConfiguration"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "kms:Decrypt"
               ],
               "Resource": "key-name"
           }
       ]
   }

   About 'ssmmessages'

   For information about ssmmessages, see Reference: ec2messages, ssmmessages, and other API calls.

   About 'kms:Decrypt'

   In this policy, the kms:Decrypt permission turns on customer key encryption and decryption for session data. If you will use AWS Key Management Service (AWS KMS) encryption for your session data, replace key-name with the Amazon Resource Name (ARN) of the KMS key you want to use, in the format arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-12345EXAMPLE.

   If you won't use AWS KMS encryption for your session data, you can remove the following content from the policy.

   ,
           {
               "Effect": "Allow",
               "Action": [
                   "kms:Decrypt"
               ],
               "Resource": "key-name"
           }

   For information about using a KMS key to encrypt session data, see Turn on KMS key encryption of session data (console).

8. Choose Review policy.

9. On the Review policy page, for Name, enter a name for the inline policy, such as SessionManagerPermissions.

10. Choose Create policy.