WSL中Linux实例无法在AWS SSM控制台显示的问题求助

尝试将WSL中的Linux实例（非EC2）纳入AWS Systems Manager管理，执行以下命令后，控制台找不到目标实例，且SSM Agent在active(running)和activating (auto-restart)状态间反复切换：

mkdir /tmp/ssm
curl https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb -o /tmp/ssm/amazon-ssm-agent.deb
sudo dpkg -i /tmp/ssm/amazon-ssm-agent.deb
sudo service amazon-ssm-agent stop
sudo -E amazon-ssm-agent -register -code "activation-code" -id "activation-id" -region "region" 
sudo service amazon-ssm-agent start

查看/var/log/amazon/ssm/errors.log得到以下错误信息：

caused by: Get "http://169.254.169.254/latest/meta-data/instance-id": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
2023-04-26 09:49:00 ERROR [newAgentIdentityInner @ identity_selector.go.99] Agent failed to assume any identity
2023-04-26 09:49:00 ERROR [NewAgentIdentity @ identity_selector.go.112] failed to find identity, retrying: failed to find agent identity
2023-04-26 09:49:07 ERROR [NewEC2Identity @ ec2_identity.go.281] [EC2Identity] failed to get identity instance id. Error: RequestError: send request failed
caused by: Get "http://169.254.169.254/latest/meta-data/instance-id": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
2023-04-26 09:49:07 ERROR [newAgentIdentityInner @ identity_selector.go.99] Agent failed to assume any identity
2023-04-26 09:49:07 ERROR [Init @ bootstrap.go.75] failed to get identity: failed to find agent identity
2023-04-26 09:49:07 ERROR [run @ agent.go.153] Error occurred when starting amazon-ssm-agent: failed to get identity: failed to find agent identity

已修改/etc/amazon/ssm/amazon-ssm-agent.json配置（填写Region和ManagedInstance信息），但问题未解决，配置内容如下：

{
    "Profile":{
        "ShareCreds" : true,
        "ShareProfile" : "",
        "ForceUpdateCreds" : false,
        "KeyAutoRotateDays": 0
    },
    "Mds": {
        "CommandWorkersLimit" : 5,
        "StopTimeoutMillis" : 20000,
        "Endpoint": "",
        "CommandRetryLimit": 15
    },
    "Ssm": {
        "Endpoint": "",
        "HealthFrequencyMinutes": 5,
        "CustomInventoryDefaultLocation" : "",
        "AssociationLogsRetentionDurationHours" : 24,
        "RunCommandLogsRetentionDurationHours" : 336,
        "SessionLogsRetentionDurationHours" : 336,
        "PluginLocalOutputCleanup": "",
        "OrchestrationDirectoryCleanup": ""
    },
    "Mgs": {
        "Region": "ap-northeast-1",
        "Endpoint": "",
        "StopTimeoutMillis" : 20000,
        "SessionWorkersLimit" : 1000,
        "DeniedPortForwardingRemoteIPs" : [
            "169.254.169.254",
            "fd00:ec2::254",
            "169.254.169.253",
            "fd00:ec2::253",
            "169.254.169.123",
            "169.254.169.250"
        ]
    },
    "Agent": {
        "Region": "ap-northeast-1",
        "OrchestrationRootDir": "",
        "SelfUpdate": false,
        "TelemetryMetricsToCloudWatch": false,
        "TelemetryMetricsToSSM": true,
        "AuditExpirationDay" : 7,
        "LongRunningWorkerMonitorIntervalSeconds": 60
    },
    "Os": {
        "Lang": "en-US",
        "Name": "",
        "Version": "1"
    },
    "S3": {
        "Endpoint": "",
        "Region": "ap-northeast-1",
        "LogBucket":"",
        "LogKey":""
    },
    "Kms": {
        "Endpoint": ""
    },
    "ManagedInstance": {
    "OnPrem": {
      "Enabled": true,
      "ActivationCode": "MyActivationCode",
      "ActivationId": "MyActivationId"
    }
  }
}

激活关联的IAM角色已附加以下策略：

• AmazonSSMManagedInstanceCore
• CloudWatchAgentServerPolicy

1. 核心问题分析 #

错误日志显示SSM Agent一直在尝试访问EC2元数据服务（169.254.169.254）获取实例ID，但WSL环境不存在该服务，导致请求超时。SSM Agent默认优先尝试EC2身份验证逻辑，即使配置了On-Prem激活信息，仍会反复触发EC2身份检测，最终导致启动失败。

2. 修复步骤 #

步骤1：强制Agent仅使用On-Prem身份

编辑SSM Agent配置文件/etc/amazon/ssm/amazon-ssm-agent.json，新增Identity配置段，明确指定优先使用OnPrem身份：

{
    // 保留原有所有配置项...
    "Identity": {
        "PreferredIdentity": "OnPrem"
    },
    "ManagedInstance": {
        "OnPrem": {
            "Enabled": true,
            "ActivationCode": "你的激活码",
            "ActivationId": "你的激活ID"
        }
    }
}

步骤2：清理Agent缓存并重启服务

删除Agent的身份缓存文件，避免残留的EC2身份逻辑干扰：

sudo rm -rf /var/lib/amazon/ssm/identity
sudo systemctl stop amazon-ssm-agent
sudo systemctl start amazon-ssm-agent

步骤3：验证Agent状态

检查Agent是否稳定运行：

sudo systemctl status amazon-ssm-agent

查看日志确认无元数据服务访问错误：

tail -f /var/log/amazon/ssm/errors.log

步骤4：检查网络连通性

确保WSL实例能访问AWS SSM服务端点，可通过curl测试：

curl https://ssm.ap-northeast-1.amazonaws.com

若无法访问，需检查WSL的网络配置（如代理、防火墙规则），确保允许出站HTTPS请求到AWS服务。

3. 额外注意事项 #

• 激活码和激活ID必须与AWS控制台创建的托管实例激活信息完全匹配，且未过期。
• 确认IAM角色的AmazonSSMManagedInstanceCore策略权限正常，该策略是Agent与SSM服务通信的核心权限。
• 若使用代理，需在SSM Agent配置的Profile段添加HttpProxy和HttpsProxy参数。

内容的提问来源于stack exchange，提问作者yoshi216