I'm trying to set up AWS Systems Manager (SSM) to patch a production Amazon Linux 1 instance. I've tried setting SSM tasks up from scratch a few times but I keep getting the error message "The specified service role is invalid". This is an area I'm a bit weak in, I need a bit of help to work out how to get automatic Linux patcing working.
I know the agent is working ok. When I go into "Managed Instances" I can see the instance is online and I have a software inventory.
Here's screen shots of everything I can think would be relevant.
Note that tasks shows the task it's running - "AWS-RunPatchBaseline"
This shows the service role in use
This shows the service role in IAM
Here's the service role trust relationships.
Here's the access log for the IAM role.
I'm happy to add more info / share more if it would help. I note that I've set up S3 logging and SNS notifications and neither of those are happening.
I also noticed that my inventory is reporting an error. It must have run once because I can see what software is on the instance, but it seems stuck now.
I can't work out how to remove the unnecessary inventory tasks.
The error message is: "1 out of 1 plugin processed, 0 success, 1 failed, 0 timedout, 0 skipped. The operation collectSoftwareInventoryItems failed because aws:softwareInventory detected multiple inventory configurations associated with one instance. Each instance can be associated with just one inventory configuration"