Policy: AWSSSMForSAPServiceLinkedRolePolicy ARN: arn:aws:iam::aws:policy/aws-service-role/AWSSSMForSAPServiceLinkedRolePolicy Allowed Actions Actions Services cloudwatch:PutMetricData cloudwatch ec2:CreateTags ec2 ec2:CreateTags ec2 ec2:CreateTags ec2 ec2:CreateTags ec2 ec2:DeleteTags ec2 ec2:DeleteTags ec2 ec2:DeleteTags ec2 ec2:DeleteTags ec2 ec2:DescribeInstanceAttribute ec2 ec2:DescribeInstanceStatus ec2 ec2:DescribeInstanceTypes ec2 ec2:DescribeInstances ec2 ec2:DescribeRouteTables ec2 ec2:DescribeSnapshots ec2 ec2:DescribeTags ec2 ec2:DescribeVolumes ec2 ec2:StartInstances ec2 ec2:StopInstances ec2 events:DeleteRule events events:DescribeRule events events:PutRule events events:PutTargets events events:RemoveTargets events iam:CreateServiceLinkedRole iam resource-groups:CreateGroup resource-groups resource-groups:CreateGroup resource-groups resource-groups:CreateGroup resource-groups resource-groups:DeleteGroup resource-groups resource-groups:GetGroup resource-groups resource-groups:GetGroupConfiguration resource-groups resource-groups:Tag resource-groups resource-groups:Tag resource-groups resource-groups:Tag resource-groups servicecatalog:AssociateAttributeGroup servicecatalog servicecatalog:CreateApplication servicecatalog servicecatalog:CreateAttributeGroup servicecatalog servicecatalog:DeleteApplication servicecatalog servicecatalog:DeleteAttributeGroup servicecatalog servicecatalog:DisassociateAttributeGroup servicecatalog servicecatalog:GetApplication servicecatalog servicecatalog:GetAttributeGroup servicecatalog servicecatalog:ListAssociatedAttributeGroups servicecatalog servicecatalog:TagResource servicecatalog servicecatalog:UpdateApplication servicecatalog ssm:DescribeDocument ssm ssm:DescribeInstanceInformation ssm ssm:GetCommandInvocation ssm ssm:SendCommand ssm ssm:SendCommand ssm