Skip to content

Service: ssm

Attached Policies

Policy ARN Policy Name
arn:aws:iam::aws:policy/ReadOnlyAccess ReadOnlyAccess
arn:aws:iam::aws:policy/SecurityAudit SecurityAudit
arn:aws:iam::aws:policy/AWSStorageGatewayFullAccess AWSStorageGatewayFullAccess
arn:aws:iam::aws:policy/AWSStorageGatewayReadOnlyAccess AWSStorageGatewayReadOnlyAccess
arn:aws:iam::aws:policy/AWSMarketplaceFullAccess AWSMarketplaceFullAccess
arn:aws:iam::aws:policy/AmazonSSMFullAccess AmazonSSMFullAccess
arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess AmazonSSMReadOnlyAccess
arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM AmazonEC2RoleforSSM
arn:aws:iam::aws:policy/job-function/ViewOnlyAccess ViewOnlyAccess
arn:aws:iam::aws:policy/job-function/SupportUser SupportUser
arn:aws:iam::aws:policy/service-role/AWSOpsWorksCMServiceRole AWSOpsWorksCMServiceRole
arn:aws:iam::aws:policy/service-role/AmazonSSMMaintenanceWindowRole AmazonSSMMaintenanceWindowRole
arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess AWSCodeBuildDeveloperAccess
arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess AWSCodeBuildAdminAccess
arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole AmazonSSMAutomationRole
arn:aws:iam::aws:policy/AmazonSSMAutomationApproverAccess AmazonSSMAutomationApproverAccess
arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy AmazonECSServiceRolePolicy
arn:aws:iam::aws:policy/AmazonECS_FullAccess AmazonECS_FullAccess
arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy AmazonSSMServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy AmazonGuardDutyServiceRolePolicy
arn:aws:iam::aws:policy/AWSCloud9User AWSCloud9User
arn:aws:iam::aws:policy/AWSCloud9Administrator AWSCloud9Administrator
arn:aws:iam::aws:policy/AWSCloud9EnvironmentMember AWSCloud9EnvironmentMember
arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy AutoScalingServiceRolePolicy
arn:aws:iam::aws:policy/AWSServiceCatalogAdminFullAccess AWSServiceCatalogAdminFullAccess
arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess AWSServiceCatalogEndUserFullAccess
arn:aws:iam::aws:policy/CloudWatchAgentAdminPolicy CloudWatchAgentAdminPolicy
arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy CloudWatchAgentServerPolicy
arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess AWSResourceGroupsReadOnlyAccess
arn:aws:iam::aws:policy/aws-service-role/AWSConfigServiceRolePolicy AWSConfigServiceRolePolicy
arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess AWSMarketplaceImageBuildFullAccess
arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerServiceRolePolicy AWSLicenseManagerServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerMemberAccountRolePolicy AWSLicenseManagerMemberAccountRolePolicy
arn:aws:iam::aws:policy/aws-service-role/CloudwatchApplicationInsightsServiceLinkedRolePolicy CloudwatchApplicationInsightsServiceLinkedRolePolicy
arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup AWSBackupServiceRolePolicyForBackup
arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore AmazonSSMManagedInstanceCore
arn:aws:iam::aws:policy/aws-service-role/AWSConfigRemediationServiceRolePolicy AWSConfigRemediationServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/ConfigConformsServiceRolePolicy ConfigConformsServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForSMS AWSServiceRoleForSMS
arn:aws:iam::aws:policy/AWSServiceCatalogEndUserReadOnlyAccess AWSServiceCatalogEndUserReadOnlyAccess
arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess AWSServiceCatalogAdminReadOnlyAccess
arn:aws:iam::aws:policy/AmazonEC2RolePolicyForLaunchWizard AmazonEC2RolePolicyForLaunchWizard
arn:aws:iam::aws:policy/AWSBackupFullAccess AWSBackupFullAccess
arn:aws:iam::aws:policy/AWSBackupOperatorAccess AWSBackupOperatorAccess
arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForImageBuilder AWSServiceRoleForImageBuilder
arn:aws:iam::aws:policy/AWSIoTDeviceTesterForFreeRTOSFullAccess AWSIoTDeviceTesterForFreeRTOSFullAccess
arn:aws:iam::aws:policy/AmazonSSMPatchAssociation AmazonSSMPatchAssociation
arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile AWSCloud9SSMInstanceProfile
arn:aws:iam::aws:policy/service-role/AWS_ConfigRole AWS_ConfigRole
arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils AmazonElasticFileSystemsUtils
arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForCloudWatchAlarmsActionSSMServiceRolePolicy AWSServiceRoleForCloudWatchAlarmsActionSSMServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy AWSSupportServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AmazonDevOpsGuruServiceRolePolicy AmazonDevOpsGuruServiceRolePolicy
arn:aws:iam::aws:policy/AdministratorAccess-Amplify AdministratorAccess-Amplify
arn:aws:iam::aws:policy/aws-service-role/AWSSystemsManagerChangeManagementServicePolicy AWSSystemsManagerChangeManagementServicePolicy
arn:aws:iam::aws:policy/AWSApplicationMigrationFullAccess AWSApplicationMigrationFullAccess
arn:aws:iam::aws:policy/aws-service-role/AWSSystemsManagerOpsDataSyncServiceRolePolicy AWSSystemsManagerOpsDataSyncServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AWSIncidentManagerServiceRolePolicy AWSIncidentManagerServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AWSSSMOpsInsightsServiceRolePolicy AWSSSMOpsInsightsServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AmazonEKSConnectorServiceRolePolicy AmazonEKSConnectorServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AmazonRDSCustomServiceRolePolicy AmazonRDSCustomServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AmazonRDSCustomPreviewServiceRolePolicy AmazonRDSCustomPreviewServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy AmazonInspector2ServiceRolePolicy
arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess AWSElasticDisasterRecoveryReadOnlyAccess
arn:aws:iam::aws:policy/aws-service-role/AWSMigrationHubOrchestratorServiceRolePolicy AWSMigrationHubOrchestratorServiceRolePolicy
arn:aws:iam::aws:policy/AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM
arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerUserSubscriptionsServiceRolePolicy AWSLicenseManagerUserSubscriptionsServiceRolePolicy
arn:aws:iam::aws:policy/aws-service-role/AmazonEKSLocalOutpostServiceRolePolicy AmazonEKSLocalOutpostServiceRolePolicy
arn:aws:iam::aws:policy/AmazonEKSLocalOutpostClusterPolicy AmazonEKSLocalOutpostClusterPolicy
arn:aws:iam::aws:policy/AmazonSSMManagedEC2InstanceDefaultPolicy AmazonSSMManagedEC2InstanceDefaultPolicy
arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess AWSRefactoringToolkitFullAccess
arn:aws:iam::aws:policy/aws-service-role/AWSResourceExplorerServiceRolePolicy AWSResourceExplorerServiceRolePolicy
arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorSSMAccess AWSFaultInjectionSimulatorSSMAccess
arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorECSAccess AWSFaultInjectionSimulatorECSAccess
arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorEC2Access AWSFaultInjectionSimulatorEC2Access
arn:aws:iam::aws:policy/aws-service-role/AWSSSMForSAPServiceLinkedRolePolicy AWSSSMForSAPServiceLinkedRolePolicy
arn:aws:iam::aws:policy/AWSApplicationMigrationSSMAccess AWSApplicationMigrationSSMAccess
arn:aws:iam::aws:policy/AWSResilienceHubAsssessmentExecutionPolicy AWSResilienceHubAsssessmentExecutionPolicy
arn:aws:iam::aws:policy/service-role/AWSMigrationHubRefactorSpaces-SSMAutomationPolicy AWSMigrationHubRefactorSpaces-SSMAutomationPolicy
arn:aws:iam::aws:policy/AmazonLaunchWizardFullAccessV2 AmazonLaunchWizardFullAccessV2
arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryLaunchActionsPolicy AWSElasticDisasterRecoveryLaunchActionsPolicy
arn:aws:iam::aws:policy/AmazonDataZoneFullAccess AmazonDataZoneFullAccess
arn:aws:iam::aws:policy/service-role/AmplifyBackendDeployFullAccess AmplifyBackendDeployFullAccess
arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerSSMFullAccess AWSDataLifecycleManagerSSMFullAccess
arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryConsoleFullAccess_v2 AWSElasticDisasterRecoveryConsoleFullAccess_v2
arn:aws:iam::aws:policy/AmazonRDSCustomInstanceProfileRolePolicy AmazonRDSCustomInstanceProfileRolePolicy
arn:aws:iam::aws:policy/aws-service-role/SSMQuickSetupRolePolicy SSMQuickSetupRolePolicy
arn:aws:iam::aws:policy/AWSSystemsManagerEnableExplorerExecutionPolicy AWSSystemsManagerEnableExplorerExecutionPolicy
arn:aws:iam::aws:policy/AWSQuickSetupDevOpsGuruPermissionsBoundary AWSQuickSetupDevOpsGuruPermissionsBoundary
arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary AWSQuickSetupPatchPolicyPermissionsBoundary
arn:aws:iam::aws:policy/AWSQuickSetupSSMHostMgmtPermissionsBoundary AWSQuickSetupSSMHostMgmtPermissionsBoundary
arn:aws:iam::aws:policy/AWSQuickSetupDistributorPermissionsBoundary AWSQuickSetupDistributorPermissionsBoundary
arn:aws:iam::aws:policy/AWSQuickSetupCFGCPacksPermissionsBoundary AWSQuickSetupCFGCPacksPermissionsBoundary
arn:aws:iam::aws:policy/AWSQuickSetupSchedulerPermissionsBoundary AWSQuickSetupSchedulerPermissionsBoundary
arn:aws:iam::aws:policy/AWSQuickSetupDeploymentRolePolicy AWSQuickSetupDeploymentRolePolicy
arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyDeploymentRolePolicy AWSQuickSetupPatchPolicyDeploymentRolePolicy
arn:aws:iam::aws:policy/ResourceGroupsTaggingAPITagUntagSupportedResources ResourceGroupsTaggingAPITagUntagSupportedResources
arn:aws:iam::aws:policy/AWSQuickSetupEnableDHMCExecutionPolicy AWSQuickSetupEnableDHMCExecutionPolicy
arn:aws:iam::aws:policy/AWSQuickSetupManagedInstanceProfileExecutionPolicy AWSQuickSetupManagedInstanceProfileExecutionPolicy
arn:aws:iam::aws:policy/AWSQuickSetupSSMLifecycleManagementExecutionPolicy AWSQuickSetupSSMLifecycleManagementExecutionPolicy
arn:aws:iam::aws:policy/AWSQuickSetupSSMDeploymentRolePolicy AWSQuickSetupSSMDeploymentRolePolicy
arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy
arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy
arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-AdministrationRolePolicy AWS-SSM-RemediationAutomation-AdministrationRolePolicy
arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-ExecutionRolePolicy AWS-SSM-RemediationAutomation-ExecutionRolePolicy
arn:aws:iam::aws:policy/SageMakerStudioProjectRoleMachineLearningPolicy SageMakerStudioProjectRoleMachineLearningPolicy
arn:aws:iam::aws:policy/service-role/SageMakerStudioDomainServiceRolePolicy SageMakerStudioDomainServiceRolePolicy
arn:aws:iam::aws:policy/service-role/SageMakerStudioDomainExecutionRolePolicy SageMakerStudioDomainExecutionRolePolicy
arn:aws:iam::aws:policy/SageMakerStudioProjectUserRolePermissionsBoundary SageMakerStudioProjectUserRolePermissionsBoundary
arn:aws:iam::aws:policy/AWSPartnerLedSupportReadOnlyAccess AWSPartnerLedSupportReadOnlyAccess
arn:aws:iam::aws:policy/SageMakerStudioFullAccess SageMakerStudioFullAccess
arn:aws:iam::aws:policy/AIOpsAssistantPolicy AIOpsAssistantPolicy
arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy AIOpsConsoleAdminPolicy
arn:aws:iam::aws:policy/AIOpsOperatorAccess AIOpsOperatorAccess
arn:aws:iam::aws:policy/AWSQuickSetupJITNADeploymentRolePolicy AWSQuickSetupJITNADeploymentRolePolicy

Allowed Actions

Action Service
ssm:* ssm
ssm:AddTagsToResource ssm
ssm:AssociateOpsItemRelatedItem ssm
ssm:CancelCommand ssm
ssm:CreateActivation ssm
ssm:CreateAssociation ssm
ssm:CreateDocument ssm
ssm:CreateOpsItem ssm
ssm:CreateOpsMetadata ssm
ssm:CreateResourceDataSync ssm
ssm:DeleteActivation ssm
ssm:DeleteAssociation ssm
ssm:DeleteDocument ssm
ssm:DeleteOpsItem ssm
ssm:DeleteOpsMetadata ssm
ssm:DeleteParameter ssm
ssm:DeleteParameter* ssm
ssm:DeleteParameters ssm
ssm:DeleteResourceDataSync ssm
ssm:DeregisterManagedInstance ssm
ssm:Describe* ssm
ssm:DescribeAssociation ssm
ssm:DescribeAssociationExecutions ssm
ssm:DescribeAutomation* ssm
ssm:DescribeAutomationExecutions ssm
ssm:DescribeAutomationStepExecutions ssm
ssm:DescribeDocument ssm
ssm:DescribeDocument* ssm
ssm:DescribeDocumentParameters ssm
ssm:DescribeDocumentPermission ssm
ssm:DescribeEffectivePatchesForPatchBaseline ssm
ssm:DescribeInstanceAssociationsStatus ssm
ssm:DescribeInstanceInformation ssm
ssm:DescribeInstanceProperties ssm
ssm:DescribeMaintenanceWindowTargets ssm
ssm:DescribeMaintenanceWindowTasks ssm
ssm:DescribeMaintenanceWindows ssm
ssm:DescribeOpsItems ssm
ssm:DescribeParameters ssm
ssm:DescribePatchBaselines ssm
ssm:DescribeSessions ssm
ssm:Get* ssm
ssm:GetAutomationExecution ssm
ssm:GetCalendarState ssm
ssm:GetCommandInvocation ssm
ssm:GetConnectionStatus ssm
ssm:GetDefaultPatchBaseline ssm
ssm:GetDeployablePatchSnapshotForInstance ssm
ssm:GetDocument ssm
ssm:GetInventory ssm
ssm:GetManifest ssm
ssm:GetOpsItem ssm
ssm:GetOpsSummary ssm
ssm:GetParameter ssm
ssm:GetParameter* ssm
ssm:GetParameters ssm
ssm:GetParametersByPath ssm
ssm:GetPatchBaseline ssm
ssm:GetResourcePolicies ssm
ssm:GetServiceSetting ssm
ssm:List* ssm
ssm:ListAssociationVersions ssm
ssm:ListAssociations ssm
ssm:ListCommand* ssm
ssm:ListCommandInvocations ssm
ssm:ListCommands ssm
ssm:ListComplianceItems ssm
ssm:ListComplianceSummaries ssm
ssm:ListDocument* ssm
ssm:ListDocumentMetadataHistory ssm
ssm:ListDocumentVersions ssm
ssm:ListDocuments ssm
ssm:ListInstanceAssociations ssm
ssm:ListInventoryEntries ssm
ssm:ListOpsMetadata ssm
ssm:ListResourceComplianceSummaries ssm
ssm:ListResourceDataSync ssm
ssm:ListTagsForResource ssm
ssm:PutComplianceItems ssm
ssm:PutConfigurePackageResult ssm
ssm:PutInventory ssm
ssm:PutParameter ssm
ssm:RegisterManagedInstance ssm
ssm:RemoveTagsFromResource ssm
ssm:ResumeSession ssm
ssm:SendAutomationSignal ssm
ssm:SendCommand ssm
ssm:StartAssociationsOnce ssm
ssm:StartAutomationExecution ssm
ssm:StartSession ssm
ssm:StopAutomationExecution ssm
ssm:TerminateSession ssm
ssm:UpdateAssociation ssm
ssm:UpdateAssociationStatus ssm
ssm:UpdateDocument ssm
ssm:UpdateDocumentDefaultVersion ssm
ssm:UpdateInstanceAssociationStatus ssm
ssm:UpdateInstanceInformation ssm
ssm:UpdateManagedInstanceRole ssm
ssm:UpdateOpsItem ssm
ssm:UpdateServiceSetting ssm
ssm:describeActivations ssm
ssm:describeAssociation ssm
ssm:describeAssociationExecutionTargets ssm
ssm:describeAssociationExecutions ssm
ssm:describeAutomationExecutions ssm
ssm:describeAutomationStepExecutions ssm
ssm:describeAvailablePatches ssm
ssm:describeDocument ssm
ssm:describeDocumentPermission ssm
ssm:describeEffectiveInstanceAssociations ssm
ssm:describeEffectivePatchesForPatchBaseline ssm
ssm:describeInstanceAssociationsStatus ssm
ssm:describeInstanceInformation ssm
ssm:describeInstancePatchStates ssm
ssm:describeInstancePatchStatesForPatchGroup ssm
ssm:describeInstancePatches ssm
ssm:describeInventoryDeletions ssm
ssm:describeMaintenanceWindowExecutionTaskInvocations ssm
ssm:describeMaintenanceWindowExecutionTasks ssm
ssm:describeMaintenanceWindowExecutions ssm
ssm:describeMaintenanceWindowSchedule ssm
ssm:describeMaintenanceWindowTargets ssm
ssm:describeMaintenanceWindowTasks ssm
ssm:describeMaintenanceWindows ssm
ssm:describeMaintenanceWindowsForTarget ssm
ssm:describeOpsItems ssm
ssm:describeParameters ssm
ssm:describePatchBaselines ssm
ssm:describePatchGroupState ssm
ssm:describePatchGroups ssm
ssm:describePatchProperties ssm
ssm:describeSessions ssm
ssm:getAutomationExecution ssm
ssm:getCalendarState ssm
ssm:getCommandInvocation ssm
ssm:getConnectionStatus ssm
ssm:getDefaultPatchBaseline ssm
ssm:getDeployablePatchSnapshotForInstance ssm
ssm:getInventorySchema ssm
ssm:getMaintenanceWindow ssm
ssm:getMaintenanceWindowExecution ssm
ssm:getMaintenanceWindowExecutionTask ssm
ssm:getMaintenanceWindowExecutionTaskInvocation ssm
ssm:getMaintenanceWindowTask ssm
ssm:getOpsItem ssm
ssm:getOpsMetadata ssm
ssm:getOpsSummary ssm
ssm:getPatchBaseline ssm
ssm:getPatchBaselineForPatchGroup ssm
ssm:getResourcePolicies ssm
ssm:getServiceSetting ssm
ssm:listAssociationVersions ssm
ssm:listAssociations ssm
ssm:listCommandInvocations ssm
ssm:listCommands ssm
ssm:listComplianceItems ssm
ssm:listComplianceSummaries ssm
ssm:listDocumentMetadataHistory ssm
ssm:listDocumentVersions ssm
ssm:listDocuments ssm
ssm:listOpsItemEvents ssm
ssm:listOpsItemRelatedItems ssm
ssm:listOpsMetadata ssm
ssm:listResourceComplianceSummaries ssm
ssm:listResourceDataSync ssm
ssm:listTagsForResource ssm