Skip to main content
IAM Policy Map

AmazonSSMFullAccess

AdminAWS managedActiveReviewedShow on mapCompare

Summary

Provides full access to Amazon SSM. The AWS Systems Manager User Guide describes it as an AWS managed policy that grants full access to the Systems Manager API and documents.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN
arn:aws:iam::aws:policy/AmazonSSMFullAccess
Default version
v4
Created
Last edited
Services
cloudwatch, ds, ec2, ec2messages, iam, logs, ssm, ssmmessages

Control-plane actions (313)

By access level: 70 List, 5 Permissions management, 80 Read, 6 Tagging, 152 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
Directory Service2 of 911 List, 1 Write; 0 restricted, 0 conditionalds:CreateComputer, ds:DescribeDirectories
EC21 of 8341 List; 0 restricted, 0 conditionalec2:DescribeInstanceStatus
EC2 MessagesAll 6 actions (see the EC2 Messages page)2 Read, 4 Write; 0 restricted, 0 conditionalec2messages:*
IAM3 of 1901 Read, 2 Write; 3 restricted, 1 conditionaliam:CreateServiceLinkedRole, iam:DeleteServiceLinkedRole, iam:GetServiceLinkedRoleDeletionStatus
CloudWatch LogsAll 133 actions (see the CloudWatch Logs page)33 List, 2 Permissions management, 26 Read, 4 Tagging, 68 Write; 0 restricted, 0 conditionallogs:*
Systems ManagerAll 164 actions (see the Systems Manager page)35 List, 3 Permissions management, 51 Read, 2 Tagging, 73 Write; 0 restricted, 0 conditionalssm:*
SSM MessagesAll 4 actions (see the SSM Messages page)4 Write; 0 restricted, 0 conditionalssmmessages:CreateControlChannel, ssmmessages:CreateDataChannel, ssmmessages:OpenControlChannel, ssmmessages:OpenDataChannel
Directory Service: 2 actions
  • ds:CreateComputer (Write)
  • ds:DescribeDirectories (List)
EC2: 1 actions
  • ec2:DescribeInstanceStatus (List)
IAM: 3 actions
  • iam:CreateServiceLinkedRole (Write)
  • iam:DeleteServiceLinkedRole (Write)
  • iam:GetServiceLinkedRoleDeletionStatus (Read)

Data-plane actions (3)

By access level: 2 Read, 1 Write.

Data-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
CloudWatch1 of 51 Write; 0 restricted, 0 conditionalcloudwatch:PutMetricData
Systems ManagerAll 2 actions (see the Systems Manager page)2 Read; 0 restricted, 0 conditionalssm:*
CloudWatch: 1 actions
  • cloudwatch:PutMetricData (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants at least 80% of the write and permissions-management actions of: logs (70 of 70), ssm (76 of 76).
  • Can read secret values or decrypt data. Reads are not a High privilege rule.

Guidance

Practical scope

One statement on Resource "*" allows cloudwatch:PutMetricData, ds:CreateComputer, ds:DescribeDirectories, ec2:DescribeInstanceStatus, logs:*, ssm:* and ec2messages:*. A second statement allows iam:CreateServiceLinkedRole on roles under aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM* when iam:AWSServiceName matches ssm.amazonaws.com. A third allows iam:DeleteServiceLinkedRole and iam:GetServiceLinkedRoleDeletionStatus on the same role path. A fourth allows ssmmessages:CreateControlChannel, CreateDataChannel, OpenControlChannel and OpenDataChannel on Resource "*".

Use cases

  • Give a user, group or role full access to the Systems Manager API and documents.

Best practices

  • AWS managed policies might not grant least-privilege permissions for your use case. The service guide recommends reducing permissions further with customer managed policies specific to your use cases.

Security considerations

  • ssm:* and logs:* apply to Resource "*", so the policy allows every Systems Manager action and every CloudWatch Logs action in the account. It also allows ec2messages:* and ds:CreateComputer.
  • The policy allows iam:DeleteServiceLinkedRole and iam:GetServiceLinkedRoleDeletionStatus on the Systems Manager service-linked role path, as well as creating that role.
  • You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Systems Manager User Guide says AWS managed policies are designed so you can start assigning permissions to users, groups and roles.

Related policies

Same service

Same domain

Frequently asked questions

When should I attach AmazonSSMFullAccess?
Attach it to users, groups or roles that need full access to the Systems Manager API and documents. It uses ssm:* and logs:* on all resources.
What does AmazonSSMFullAccess grant?
It allows ssm:*, logs:* and ec2messages:* on all resources, plus cloudwatch:PutMetricData, ds:CreateComputer, ds:DescribeDirectories, ec2:DescribeInstanceStatus and four ssmmessages channel actions. It also allows creating and deleting the Systems Manager service-linked role and checking its deletion status.
What are the security risks of AmazonSSMFullAccess?
ssm:* and logs:* on all resources give broad control of Systems Manager and CloudWatch Logs. The policy can delete the Systems Manager service-linked role. AWS managed policies might not grant least-privilege permissions, and an AWS update to the policy affects every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:PutMetricData",
        "ds:CreateComputer",
        "ds:DescribeDirectories",
        "ec2:DescribeInstanceStatus",
        "logs:*",
        "ssm:*",
        "ec2messages:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "ssm.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:DeleteServiceLinkedRole",
        "iam:GetServiceLinkedRoleDeletionStatus"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v4, edited by AWS on 2019-11-20. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSSMFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSSMFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSSMFullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMFullAccess

Terraform

resource "aws_iam_role_policy_attachment" "amazonssmfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMFullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMFullAccess"),
);

Sources