From e60970dfdcdf356e778d025acbf7de93283295c7 Mon Sep 17 00:00:00 2001 From: Piyusha Varshney Date: Thu, 17 Sep 2026 13:29:36 +0000 Subject: [PATCH] Enhance IAM policy in RA-ec2-dcv.yml to allow additional SSM and EC2 message actions --- cft-templates/RA-ec2-dcv.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/cft-templates/RA-ec2-dcv.yml b/cft-templates/RA-ec2-dcv.yml index 6079f91..8440688 100644 --- a/cft-templates/RA-ec2-dcv.yml +++ b/cft-templates/RA-ec2-dcv.yml @@ -51,6 +51,27 @@ Resources: - ssm:GetParameters - ssm:DescribeParameters Resource: "*" + - Sid: AllowSSMAgentCommunication + Effect: Allow + Action: + - ssm:UpdateInstanceInformation + - ssm:GetDocument + - ssm:DescribeDocument + - ssm:GetManifest + - ssm:ListInstanceAssociations + - ssm:PutInventory + - ssm:PutComplianceItems + - ssmmessages:CreateControlChannel + - ssmmessages:CreateDataChannel + - ssmmessages:OpenControlChannel + - ssmmessages:OpenDataChannel + - ec2messages:AcknowledgeMessage + - ec2messages:DeleteMessage + - ec2messages:FailMessage + - ec2messages:GetEndpoint + - ec2messages:GetMessages + - ec2messages:SendReply + Resource: "*" - Sid: AllowKMSDecrypt Effect: Allow Action: