SSM自定义策略遇AccessDeniedException，请求排查配置遗漏

你的IAM策略遗漏了SSM会话资源的授权。调用ssm:StartSession动作时，AWS会创建一个SSM会话实例，这个会话本身也是需要被授权的资源类型，仅授权EC2实例和SSM文档不足以完成会话启动。

修正后的策略方案1（明确授权所有必要资源） #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ssm:StartSession",
            "Resource": [
                "arn:aws:ssm:us-east-1:**************:document/AWS-StartPortForwardingSessionToRemoteHost",
                "arn:aws:ec2:us-east-1:**************:instance/*",
                "arn:aws:ssm:us-east-1:**************:session/*"
            ],
            "Effect": "Allow",
            "Sid": "EnableSSMSession"
        },
        {
            "Action": "ec2:DescribeInstances",
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "DescribeEC2"
        }
    ]
}

更安全的修正方案2（通过条件限制文档，同时缩小会话资源范围） #

如果需要更严格的权限控制，可以通过Condition限制仅允许使用指定的会话文档，并将会话资源限定为当前用户专属：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ssm:StartSession",
            "Resource": [
                "arn:aws:ec2:us-east-1:**************:instance/*",
                "arn:aws:ssm:us-east-1:**************:session/${aws:username}-*"
            ],
            "Effect": "Allow",
            "Sid": "EnableSSMSession",
            "Condition": {
                "StringEquals": {
                    "ssm:DocumentName": "AWS-StartPortForwardingSessionToRemoteHost"
                }
            }
        },
        {
            "Action": "ec2:DescribeInstances",
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "DescribeEC2"
        }
    ]
}

内容的提问来源于stack exchange，提问作者quartaela