AWS SSM: permissions required for aws:domainJoin? - amazon-web-services

Question

I am trying to setup an EC2 role to allow an instance to join a domain using the New-SSMAssociation powershell cmdlet. Does anyone know what the minimum permissions required to accomplish this are?
I've read the article here https://aws.amazon.com/premiumsupport/knowledge-center/ec2-systems-manager-dx-domain/ but the AmazonEC2RoleforSSM is being deprecated in favor of the AmazonSSMManagedInstanceCore policy however when using that policy in combination with the AmazonSSMDirectoryServiceAccess policy I get an error:
New-SSMAssociation : User: arn:aws:sts:::assumed-role/MyEC2Role/ is not
authorized to perform: ssm:CreateAssociation on resource:
arn:aws:ec2:us-east-1::instance/
The only way I have been able to get it to work is with ssm:*, however I would prefer not to do that if possible. The combined policy I am using is(without the ssm:*):
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstanceStatus"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation"
],
"Resource": "arn:aws:ssm:<region>:<account-id>:document/JoinDomain"
},
{
"Effect": "Allow",
"Action": [
"ds:CreateComputer",
"ds:DescribeDirectories"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:DescribeAssociation",
"ssm:GetDeployablePatchSnapshotForInstance",
"ssm:GetDocument",
"ssm:DescribeDocument",
"ssm:GetManifest",
"ssm:GetParameters",
"ssm:ListAssociations",
"ssm:ListInstanceAssociations",
"ssm:PutInventory",
"ssm:PutComplianceItems",
"ssm:PutConfigurePackageResult",
"ssm:UpdateAssociationStatus",
"ssm:UpdateInstanceAssociationStatus",
"ssm:UpdateInstanceInformation"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssmmessages:CreateControlChannel",
"ssmmessages:CreateDataChannel",
"ssmmessages:OpenControlChannel",
"ssmmessages:OpenDataChannel"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2messages:AcknowledgeMessage",
"ec2messages:DeleteMessage",
"ec2messages:FailMessage",
"ec2messages:GetEndpoint",
"ec2messages:GetMessages",
"ec2messages:SendReply"
],
"Resource": "*"
}
]
}

Answer 1

The appoach that worked in our environment.
Create a IAM Role that has
"Statement": [
{
"Sid": "SSMDocument",
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation"
],
"Resource": [
"arn:aws:ec2:${AWS_REGION}:${AWS_ACCOUNT}:instance/*",
"arn:aws:ssm:${AWS_REGION}:${AWS_ACCOUNT}:document/${SSM_DOCUMENT_NAME}"
]
}
]
plus the pre-defined policies AmazonSSMDirectoryServiceAccess and AmazonSSMManagedInstanceCore
userdata as follows:
<powershell>
[Environment]::SetEnvironmentVariable("ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE", "true", "Machine")
[Environment]::SetEnvironmentVariable("ECS_ENABLE_CONTAINER_METADATA", "true", "Machine")
Import-Module ECSTools
Initialize-ECSAgent -Cluster '${ECS_CLUSTER_NAME}' -EnableTaskIAMRole
Set-DefaultAWSRegion -Region ${AWS_REGION}
Set-Variable -name instance_id -value (Invoke-Restmethod -uri http://169.254.169.254/latest/meta-data/instance-id)
New-SSMAssociation -Name "${SSM_DOCUMENT_NAME}" -Target #{Key="instanceids";Values=#($instance_id)}
</powershell>
terraform code fragment for SSM Document
data "aws_directory_service_directory" "domain_controller" {
directory_id = var.directory_id
}
data "template_file" "userdata" {
template = file("${path.module}/files/userdata.ps1")
vars = {
SSM_DOCUMENT_NAME = aws_ssm_document.ad_join_domain.name
AWS_REGION = var.region
ECS_CLUSTER_NAME = local.cluster_name
}
}
resource "aws_ssm_document" "ad_join_domain" {
name = "${var.environment}-ad-join-domain"
document_type = "Command"
content = jsonencode(
{
"schemaVersion" = "2.2"
"description" = "join aws directory services domain"
"mainSteps" = [
{
"action" = "aws:domainJoin",
"name" = "domainJoin",
"inputs" = {
"directoryId" : data.aws_directory_service_directory.domain_controller.id,
"directoryName" : data.aws_directory_service_directory.domain_controller.name
"dnsIpAddresses" : sort(data.aws_directory_service_directory.domain_controller.dns_ip_addresses)
}
}
]
}
)
tags = {
environment = var.environment
}
}