AWS Systems Manager (ssm)

Additions

Actions

• RequestManagedInstanceRoleToken
  
  • Description:  Grants permission to SSM Agent to retrieve temporary credentials to access the managed node (internal Systems Manager call)
  • Access:  Write
  • Resources: 

    Name: instance

    Required: No

    Name: managed-instance

    Required: No

  • Conditions: 

    ssm:NodeAccountId

    ssm:NodeOrgId

• UpdateManagedInstancePublicKey
  
  • Description:  Grants permission to SSM Agent to update the public key of the managed node after rotating the key pair (internal Systems Manager call)
  • Access:  Write
  • Resources: 

    Name: instance

    Required: No

    Name: managed-instance

    Required: No

  • Conditions: 

    ssm:NodeAccountId

    ssm:NodeOrgId

Conditions

• ssm:NodeAccountId
  
  • Description:  Filters access by the AWS account ID associated with the managed node making the request. Available only in VPC endpoint policies and service control policies (SCPs)
  • Type:  String
• ssm:NodeOrgId
  
  • Description:  Filters access by the AWS Organizations ID associated with the managed node making the request. Available only in VPC endpoint policies and service control policies (SCPs)
  • Type:  String

Updates

Actions

• RegisterManagedInstance
  
  Conditions
  
  • ＋ ssm:NodeAccountId
  • ＋ ssm:NodeOrgId