The main things to do to resolve this are:
Check all the steps in Session Manager Getting Started have been done
Ensure the "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" policy is attached to the EC2 instance role
Ensure that AWS Organisations isn't blocking any of the services that are required. Key services you need to allow in organisations are
I figured out that I also need to add the Lambda's role as a "key user" of the CMK. See https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-users for details.
This can be done through the console by editing the CMK, then scrolling down to the Key Users section.