Policy: AmazonSSMAutomationRole ARN: arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole Allowed Actions Actions Services cloudformation:CreateStack cloudformation cloudformation:DeleteStack cloudformation cloudformation:DescribeStackEvents cloudformation cloudformation:DescribeStacks cloudformation cloudformation:UpdateStack cloudformation ec2:CopyImage ec2 ec2:CreateImage ec2 ec2:CreateTags ec2 ec2:DeleteSnapshot ec2 ec2:DeleteTags ec2 ec2:DeregisterImage ec2 ec2:DescribeImages ec2 ec2:DescribeInstanceStatus ec2 ec2:DescribeTags ec2 ec2:RunInstances ec2 ec2:StartInstances ec2 ec2:StopInstances ec2 ec2:TerminateInstances ec2 lambda:InvokeFunction lambda sns:Publish sns ssm:* ssm