I'm trying to set up AWS Systems Manager (SSM) to patch a production Amazon Linux 1 instance. I've tried setting SSM tasks up from scratch a few times but I keep getting the error message "The specified service role is invalid". This is an area I'm a bit weak in, I need a bit of help to work out how to get automatic Linux patcing working.

I know the agent is working ok. When I go into "Managed Instances" I can see the instance is online and I have a software inventory.

SSM Setup

Here's screen shots of everything I can think would be relevant.

Maintenance Window

Window Details

Note that tasks shows the task it's running - "AWS-RunPatchBaseline"


This shows the service role in use

Service Role

This shows the service role in IAM


Here's the service role trust relationships.


Here's the access log for the IAM role.


I'm happy to add more info / share more if it would help. I note that I've set up S3 logging and SNS notifications and neither of those are happening.

Inventory Problem

I also noticed that my inventory is reporting an error. It must have run once because I can see what software is on the instance, but it seems stuck now.

I can't work out how to remove the unnecessary inventory tasks.

Inventory Problem

The error message is: "1 out of 1 plugin processed, 0 success, 1 failed, 0 timedout, 0 skipped. The operation collectSoftwareInventoryItems failed because aws:softwareInventory detected multiple inventory configurations associated with one instance. Each instance can be associated with just one inventory configuration"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.