配置EC2角色实现域加入：SSM最小权限需求咨询

你碰到的ssm:CreateAssociation权限报错，核心原因是这个API的资源配置不完整——CreateAssociation操作需要同时指定目标EC2实例的ARN和JoinDomain SSM文档的ARN作为授权资源，而你当前的策略只覆盖了文档，没包含实例资源，导致权限校验失败。

下面是满足需求的最小权限策略，我已经修正了关键的资源配置：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstanceStatus"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:CreateAssociation"
            ],
            "Resource": [
                "arn:aws:ssm:<region>:<account-id>:document/JoinDomain",
                "arn:aws:ec2:<region>:<account-id>:instance/<instance-id>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ds:CreateComputer",
                "ds:DescribeDirectories"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeAssociation",
                "ssm:GetDeployablePatchSnapshotForInstance",
                "ssm:GetDocument",
                "ssm:DescribeDocument",
                "ssm:GetManifest",
                "ssm:GetParameters",
                "ssm:ListAssociations",
                "ssm:ListInstanceAssociations",
                "ssm:PutInventory",
                "ssm:PutComplianceItems",
                "ssm:PutConfigurePackageResult",
                "ssm:UpdateAssociationStatus",
                "ssm:UpdateInstanceAssociationStatus",
                "ssm:UpdateInstanceInformation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateControlChannel",
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:OpenDataChannel"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2messages:AcknowledgeMessage",
                "ec2messages:DeleteMessage",
                "ec2messages:FailMessage",
                "ec2messages:GetEndpoint",
                "ec2messages:GetMessages",
                "ec2messages:SendReply"
            ],
            "Resource": "*"
        }
    ]
}

关键权限说明： #

• ssm:CreateAssociation资源修正：现在同时包含JoinDomain文档和目标实例的ARN，这是解决报错的核心——AWS需要确认你有权限针对该实例创建关联。如果需要批量操作，可以把实例ARN改成arn:aws:ec2:<region>:<account-id>:instance/*，但遵循最小权限原则的话，建议限定具体实例或用标签过滤（比如添加条件："Condition": {"StringEquals": {"ec2:ResourceTag/YourTagKey": "YourTagValue"}}）。
• 目录服务权限：ds:CreateComputer负责在AD中创建计算机对象，ds:DescribeDirectories用于获取域目录的基本信息，这两个是加入域的必备权限。
• SSM基础通信权限：剩下的ssm:*、ssmmessages:*和ec2messages:*权限是SSM Agent与AWS服务正常通信、上报状态、接收指令的基础，对应AmazonSSMManagedInstanceCore策略中的核心内容，不能省略。

替换策略中的<region>、<account-id>、<instance-id>为你的实际信息后，就能正常执行New-SSMAssociation命令加入域了，无需授予宽泛的ssm:*权限。

内容的提问来源于stack exchange，提问作者Pathead