I am trying to access an ec2 instance using AWS systems manager for that I've created a role attached to the following policies.

  1. AmazonEC2RoleforSSM

  2. AmazonSSMAutomationApproverAccess

  3. AmazonSSMFullAccess

  4. AmazonSSMAutomationRole

And the role is attached to the ec2 instances. The ec2 instance is listed in the session manager ec2 instance list however when I try to connect I am getting the following error

the version of SSM Agent on the instance supports Session Manager, but the instance is not configured for use with AWS Systems Manager. Verify that the IAM instance profile attached to the instance includes the required permissions

Tried the troubleshooting methods but still getting the following error and one more thing even I removed the attached role the ec2 instance still showing up in the session manager instance list

  • I am noticing the same issue. happens intermittently, don't know what causes it. Oct 17, 2019 at 22:01
  • Did you find any solution? It just started happening in one of my instances
    – Tedi
    Jan 13, 2020 at 18:42

1 Answer 1


The main things to do to resolve this are:

  • Check all the steps in Session Manager Getting Started have been done
  • Ensure the "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" policy is attached to the EC2 instance role
  • Ensure that AWS Organisations isn't blocking any of the services that are required. Key services you need to allow in organisations are

Key services for Session Manager

  • If you are in a private subnet you need to ensure that you can either access the internet via NAT, or you need to add the following VPC endpoints (docs link)

VPC Endpoints Required

  • Security groups need to allow your instance and the VPC endpoints inbound access on port 443 from your entire VPC. Outbound doesn't seem to be required. I can't say it's exactly right but seems to work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .