AWS SSM: permissions required for aws:domainJoin?

Question

I am trying to setup an EC2 role to allow an instance to join a domain using the New-SSMAssociation powershell cmdlet. Does anyone know what the minimum permissions required to accomplish this are?

I've read the article here https://aws.amazon.com/premiumsupport/knowledge-center/ec2-systems-manager-dx-domain/ but the AmazonEC2RoleforSSM is being deprecated in favor of the AmazonSSMManagedInstanceCore policy however when using that policy in combination with the AmazonSSMDirectoryServiceAccess policy I get an error: New-SSMAssociation : User: arn:aws:sts:::assumed-role/MyEC2Role/ is not authorized to perform: ssm:CreateAssociation on resource: arn:aws:ec2:us-east-1::instance/

The only way I have been able to get it to work is with ssm:*, however I would prefer not to do that if possible. The combined policy I am using is(without the ssm:*):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstanceStatus"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:CreateAssociation"
            ],
            "Resource": "arn:aws:ssm:<region>:<account-id>:document/JoinDomain"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ds:CreateComputer",
                "ds:DescribeDirectories"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeAssociation",
                "ssm:GetDeployablePatchSnapshotForInstance",
                "ssm:GetDocument",
                "ssm:DescribeDocument",
                "ssm:GetManifest",
                "ssm:GetParameters",
                "ssm:ListAssociations",
                "ssm:ListInstanceAssociations",
                "ssm:PutInventory",
                "ssm:PutComplianceItems",
                "ssm:PutConfigurePackageResult",
                "ssm:UpdateAssociationStatus",
                "ssm:UpdateInstanceAssociationStatus",
                "ssm:UpdateInstanceInformation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateControlChannel",
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:OpenDataChannel"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2messages:AcknowledgeMessage",
                "ec2messages:DeleteMessage",
                "ec2messages:FailMessage",
                "ec2messages:GetEndpoint",
                "ec2messages:GetMessages",
                "ec2messages:SendReply"
            ],
            "Resource": "*"
        }
    ]
}

score 0 · Answer 1 · answered Sep 22 '20 at 22:15

The appoach that worked in our environment.
Create a IAM Role that has

"Statement": [
        {
            "Sid": "SSMDocument",
            "Effect": "Allow",
            "Action": [
                "ssm:CreateAssociation"
            ],
            "Resource": [
                "arn:aws:ec2:${AWS_REGION}:${AWS_ACCOUNT}:instance/*",
                "arn:aws:ssm:${AWS_REGION}:${AWS_ACCOUNT}:document/${SSM_DOCUMENT_NAME}"
            ]
        }
    ]

plus the pre-defined policies AmazonSSMDirectoryServiceAccess and AmazonSSMManagedInstanceCore

userdata as follows:

<powershell>
[Environment]::SetEnvironmentVariable("ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE", "true", "Machine")
[Environment]::SetEnvironmentVariable("ECS_ENABLE_CONTAINER_METADATA", "true", "Machine")
Import-Module ECSTools
Initialize-ECSAgent -Cluster '${ECS_CLUSTER_NAME}' -EnableTaskIAMRole
Set-DefaultAWSRegion -Region ${AWS_REGION}
Set-Variable -name instance_id -value (Invoke-Restmethod -uri http://169.254.169.254/latest/meta-data/instance-id)
New-SSMAssociation -Name "${SSM_DOCUMENT_NAME}"  -Target @{Key="instanceids";Values=@($instance_id)}
</powershell>

terraform code fragment for SSM Document

data "aws_directory_service_directory" "domain_controller" {
  directory_id = var.directory_id
}
data "template_file" "userdata" {
  template = file("${path.module}/files/userdata.ps1")
  vars = {
    SSM_DOCUMENT_NAME = aws_ssm_document.ad_join_domain.name
    AWS_REGION        = var.region
    ECS_CLUSTER_NAME  = local.cluster_name
  }
}

resource "aws_ssm_document" "ad_join_domain" {
  name          = "${var.environment}-ad-join-domain"
  document_type = "Command"
  content = jsonencode(
    {
      "schemaVersion" = "2.2"
      "description"   = "join aws directory services domain"
      "mainSteps" = [
        {
          "action" = "aws:domainJoin",
          "name"   = "domainJoin",
          "inputs" = {
            "directoryId" : data.aws_directory_service_directory.domain_controller.id,
            "directoryName" : data.aws_directory_service_directory.domain_controller.name
            "dnsIpAddresses" : sort(data.aws_directory_service_directory.domain_controller.dns_ip_addresses)
          }
        }
      ]
    }
  )
  tags = {
    environment = var.environment
  }
}

AWS SSM: permissions required for aws:domainJoin?

1 Answers1