Why does a human IAM role have SSM message-channel permissions?
Asked by
MellowPine47
I'm reviewing an IAM role named xyz that will be assumed by a user. It includes ssmmessages:CreateDataChannel, ssmmessages:OpenDataChannel, and ssmmessages:CreateControlChannel, with Resource set to * and an IP-based condition. My understanding is that these permissions are normally granted to the instance profile used by the Systems Manager Agent so an EC2 instance can communicate with Systems Manager. Why would they appear in a human-assumable role, and what legitimate use cases could require them?
Answers
These permissions are primarily associated with the Systems Manager Agent and Session Manager’s control and data channels. They are normally placed on an EC2 instance role, not a general-purpose human role. A likely explanation is that someone copied permissions from the AWS-managed AmazonSSMManagedInstanceCore policy into this role. The duplicated OpenDataChannel entry also suggests a copy-and-paste or configuration mistake. Ask the role owner what workflow requires them and remove them if there is no documented need.
Reply to this answer
The Resource * and IP condition do not by themselves make the permissions appropriate. The condition may limit where the role can be used, but it does not identify which managed instance or session the channel belongs to. Treat this as an access-review finding until the owner can explain the use case, and compare the role with the permissions actually required by the intended Session Manager workflow.
Reply to this answer
A user who starts a Session Manager session generally needs permissions such as ssm:StartSession, while the managed instance typically needs the ssmmessages permissions to establish the underlying channels. Those are different sides of the workflow, so these actions are unusual in a human role unless the role is being used by some custom session-management tooling or automation. Verify the role’s trust policy, CloudTrail activity, and the role’s complete policy set.
Reply to this answer
Add your answer
Answers are reviewed before publication.
QuartzMango31: It’s worth checking whether this role is actually used for a Session Manager or remote-management workflow before concluding it is unused. CloudTrail records for AssumeRole and the ssmmessages actions should help confirm that.