Policy: AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy ARN: arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy Allowed Actions Actions Services ec2:DescribeInstances ec2 ec2:DescribeInternetGateways ec2 ec2:DescribeSecurityGroups ec2 ec2:DescribeSubnets ec2 ec2:DescribeVpcAttribute ec2 ec2:DescribeVpcEndpoints ec2 ec2:DescribeVpcs ec2 iam:PassRole iam kms:Decrypt kms kms:GenerateDataKey kms ssm:DescribeAutomationExecutions ssm ssm:DescribeAutomationStepExecutions ssm ssm:DescribeInstanceInformation ssm ssm:GetAutomationExecution ssm ssm:StartAutomationExecution ssm