2

I am trying to access an ec2 instance using AWS systems manager for that I've created a role attached to the following policies.

  1. AmazonEC2RoleforSSM

  2. AmazonSSMAutomationApproverAccess

  3. AmazonSSMFullAccess

  4. AmazonSSMAutomationRole

And the role is attached to the ec2 instances. The ec2 instance is listed in the session manager ec2 instance list however when I try to connect I am getting the following error

the version of SSM Agent on the instance supports Session Manager, but the instance is not configured for use with AWS Systems Manager. Verify that the IAM instance profile attached to the instance includes the required permissions

Tried the troubleshooting methods but still getting the following error and one more thing even I removed the attached role the ec2 instance still showing up in the session manager instance list

shellakkshellu
  • 115
  • 2
  • 8

1 Answers1

0

The main things to do to resolve this are:

  • Check all the steps in Session Manager Getting Started have been done
  • Ensure the "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" policy is attached to the EC2 instance role
  • Ensure that AWS Organisations isn't blocking any of the services that are required. Key services you need to allow in organisations are

Key services for Session Manager

ec2:*
ec2messages:*
ssm:*
ssmmessages:*
s3:*
  • If you are in a private subnet you need to ensure that you can either access the internet via NAT, or you need to add the following VPC endpoints (docs link)

VPC Endpoints Required

com.amazonaws.ap-southeast-2.s3
com.amazonaws.ap-southeast-2.ssmmessages
com.amazonaws.ap-southeast-2.ec2messages
com.amazonaws.ap-southeast-2.ssm
  • Security groups need to allow your instance and the VPC endpoints inbound access on port 443 from your entire VPC. Outbound doesn't seem to be required. I can't say it's exactly right but seems to work.
Tim
  • 30,383
  • 6
  • 47
  • 77