列表关联的 AWS 会话管理器例外

Question

在 AWS 上对会话管理器执行运行状况检查时遇到以下错误：

amazon-ssm-agent[17614]: 2020-05-19 12:57:35 ERROR [MessagingDeliveryService] [Association] Unable to load instance associations, unable to retrieve associations unable to retrieve associations AccessDeniedException: User: arn:aws:sts::395456465418:assumed-role/SessionManagerInstanceProfile/i-02c8c2ae1dce2ce84 is not authorized to perform: ssm:ListAssociations on resource: arn:aws:ssm:ap-southeast-1:395456465418:*

认为这是由于为实例 IAM 策略授予的权限不足造成的。但是，我应该授予哪些其他访问权限才能解决此错误？

以下是从 AWS 文档复制的当前内联策略。

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssmmessages:CreateControlChannel",
"ssmmessages:CreateDataChannel",
"ssmmessages:OpenControlChannel",
"ssmmessages:OpenDataChannel",
"ssm:UpdateInstanceInformation"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": "arn:aws:s3:::ec2-sessionmanager-logs"
},
{
"Effect": "Allow",
"Action": [
"s3:GetEncryptionConfiguration"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "kms:GenerateDataKey",
"Resource": "*"
}
]

}

Answer 1

错误消息指示：

无权执行：ssm：列表关联

操作：

授予列出指定 SSM 文档或托管实例的关联的权限

因此，策略应包含：ssm:ListAssociations。目前，您在问题中发布的政策中不允许执行此类操作。