首先只有特定版本的OS会默认附带SSM Agent。

预安装了 SSM Agent 的 Amazon Machine Images（AMIs） - AWS Systems Manager

其次EC的instance role必须有一个叫“AmazonSSMManagedInstanceCore”的策略

 

如何给IAM User赋权，让他们可以使用SSM会话：

{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["ec2:DescribeInstanceAttribute","ec2:DescribeVolumeAttribute"],"Resource": ["arn:aws-cn:ec2:*:xxxxxxxxx2:instance/*","arn:aws-cn:ec2:*:xxxxxxxxx2:volume/*"]},{"Sid": "VisualEditor1","Effect": "Allow","Action": ["ec2:DescribeInstances","ec2:DescribeVolumeStatus","ssm:DescribeInstanceInformation","ec2:DescribeTags","ec2:DescribeVolumes","ec2:DescribeInstanceStatus"],"Resource": "*"},{"Sid": "VisualEditor2","Effect": "Allow","Action": ["ssm:GetConnectionStatus","ssm:StartSession"],"Resource": "arn:aws-cn:ec2:*:xxxxxxxxx2:instance/*"},{"Sid": "VisualEditor3","Effect": "Allow","Action": ["ec2:StartInstances","ec2:StopInstances"],"Resource": "arn:aws-cn:ec2:*:xxxxxxxxx2:instance/*"}]
}