1

I'm trying to use AWS's SNS with SSM but getting an error about roles.

Here's the error:

botocore.errorfactory.InvalidRole: An error occurred (InvalidRole) when calling the SendCommand operation: ServiceRoleArn is not valid: arn:aws:iam::<account #>:role/FullSNS

Here's the relevant code:

response = client.send_command(
InstanceIds=[
    '<instance id>',
],
DocumentName='AWS-RunShellScript',
Parameters={
    'commands': [
        '<command>',
    ],
    'workingDirectory': [
        '<directory>'
    ]
},
OutputS3BucketName='<s3 bucket>',
ServiceRoleArn='arn:aws:iam::<account #>:role/FullSNS',
NotificationConfig={
    'NotificationArn': 'arn:aws:sns:us-east-1:<account #>:MyTestTopic',
    'NotificationEvents': [
        'All',
        ],
    'NotificationType': 'Command'
    }
)

And here's the policy on that role:

{
  "Version": "2012-10-17",
  "Statement": [
{
  "Action": [
    "sns:*"
  ],
  "Effect": "Allow",
  "Resource": "*"
}
]
}

The above is with boto3 but I get the same error if I try it within the console.

user1090661
  • 111
  • 7

1 Answers1

9

I wish the AWS documentation was more clear on this point, but I also had to edit the trust relationship on that IAM role to look like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
         "Service": "ssm.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
user1090661
  • 111
  • 7
  • can't figure out how to do it. docs i found: https://docs.aws.amazon.com/systems-manager/latest/userguide/rc-sns-notifications.html still fails – Franz Ebner Jun 26 '18 at 12:21
  • You have to select the role in IAM Roles and then edit the Trust Relationship to have it working. – Yug Singh Jun 04 '21 at 07:26