I'm reviewing an IAM role named xyz that will be assumed by a user. It includes ssmmessages:CreateDataChannel, ssmmessages:OpenDataChannel, and ssmmessages:CreateControlChannel, with Resource set to * and an IP-based condition. My understanding is that these permissions are normally granted to the instance profile used by the Systems Manager Agent so an EC2 instance can communicate with Systems Manager. Why would they appear in a human-assumable role, and what legitimate use cases could require them?
1 Answer
These permissions are primarily associated with the Systems Manager Agent and Session Manager’s control and data channels. They are normally placed on an EC2 instance role, not a general-purpose human role. A likely explanation is that someone copied permissions from the AWS-managed AmazonSSMManagedInstanceCore policy into this role. The duplicated OpenDataChannel entry also suggests a copy-and-paste or configuration mistake. Ask the role owner what workflow requires them and remove them if there is no documented need.
It’s worth checking whether this role is actually used for a Session Manager or remote-management workflow before concluding it is unused. CloudTrail records for AssumeRole and the ssmmessages actions should help confirm that.