Cross Account SSM session: AccessDeniedException

Question

I have two AWS accounts and one role in each account: Account-A have RoleA and Account-B have RoleB.

RoleA will assume the RoleB to be able to connect in an EC2 instance in Account-B through ssm start-session.

Using the RoleA, I'm able to assume the RoleB and describe the instances in Account-B using aws cli, but I can't start a ssm session due the following error:

An error occurred (AccessDeniedException) when calling the TerminateSession operation: User: arn:aws:sts::222222222222:assumed-role/RoleB/RoleB-SSM-test is not authorized to perform: ssm:TerminateSession on resource: arn:aws:ssm:us-east-1:222222222222:assumed-role/RoleB/RoleB-SSM-test-000000000000 because no identity-based policy allows the ssm:TerminateSession action

RoleA policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "sts:AssumeRole"
               ],
               "Resource": [
                   "arn:aws:iam::222222222222:role/RoleB"
               ]
           }
       ]
   }

RoleB policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "",
               "Effect": "Allow",
               "Action": [
                   "ssm:DescribeSessions",
                   "ssm:GetConnectionStatus",
                   "ssm:DescribeInstanceProperties",
                   "ec2:DescribeInstances",
                   "ssm:StartSession"
               ],
               "Resource": [
                   "arn:aws:ec2:us-east-1:222222222222:instance/i-123456abc789102de",
                   "arn:aws:ssm:us-east-1:222222222222:document/SSM-SessionManagerRunShell",
                   "arn:aws:ssm:us-east-1:222222222222:document/AWS-StartSSHSession"
               ]
           },
           {
               "Sid":"",
               "Effect":"Allow",
               "Action": [
                   "ssm:TerminateSession"
               ],
               "Resource": "*",
               "Condition": {
                   "StringLike": {
                       "ssm:resourceTag/aws:ssmmessages:session-id": [
                           "AROAXXXXXXXXXXXXX"
                       ]
                   }
               }
   
           }
       ]
   }

Originally, the ssm:TerminateSession in RoleB policy didn't have a condition and was alongside the other actions, I did this change to try solve this error, but no success, same error message.

What I'm doing wrong?

score 1 · Accepted Answer · answered Mar 30 '23 at 12:42

Your RoleB policy is missing some permissions. According to the documentation, you need kms:GenerateDataKey to encrypt session data, also access to the document reated by SSM. Here is the example policy in the documentation:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws:ec2:region:account-id:instance/instance-id",
                "arn:aws:ssm:region:account-id:document/SSM-SessionManagerRunShell" 
            ],
            "Condition": {
                "BoolIfExists": {
                    "ssm:SessionDocumentAccessCheck": "true" 
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeSessions",
                "ssm:GetConnectionStatus",
                "ssm:DescribeInstanceProperties",
                "ec2:DescribeInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:TerminateSession",
                "ssm:ResumeSession"
            ],
            "Resource": [
                "arn:aws:ssm:*:*:session/${aws:username}-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:GenerateDataKey" 
            ],
            "Resource": "key-name"
        }
    ]
}

Ref: https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.html#restrict-access-quickstart-end-user

Cross Account SSM session: AccessDeniedException

1 Answers1