title: How to configure IAM role to enable SSM for a new EC2 instance?
body: <p>I'm running the following:</p>
  <pre class="lang-sh prettyprint-override"><code>KEY=test
  QUERY=ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20210430
  
  aws ec2 create-key-pair --key-name $KEY --query 'KeyMaterial' --output text &gt; $KEY.pem
  chmod 600 $KEY.pem
  
  aws ec2 create-security-group --group-name &quot;$KEY&quot; --description &quot;$KEY&quot; --output text &gt; $KEY.sg.txt
  SGID=$(cat $KEY.sg.txt)
  aws ec2 authorize-security-group-ingress --group-id $SGID --protocol tcp --port 22 --cidr 0.0.0.0/0 &gt; $KEY.sg.json
  
  AMIID=$(aws ec2 describe-images --filters &quot;Name=name,Values=$QUERY&quot; --query &quot;reverse(sort_by(Images, &amp;CreationDate))[0].[ImageId]&quot; --output text)
  INSTANCEID=$(aws ec2 run-instances --count 1 --instance-type t2.micro --key-name &quot;$KEY&quot; --security-group-ids &quot;$KEY&quot; --image-id $AMIID --query 'Instances[*].InstanceId' --output text)
  
  # after a wait, instance appears running
  
  aws ssm describe-instance-information --output text
  # prints nothing
  
  aws ssm send-command --instance-ids &quot;$INSTANCEID&quot; --document-name &quot;AWS-RunShellScript&quot; --comment &quot;IP config&quot; --parameters commands=ifconfig --output text
  # fails with invalid InstanceId
  </code></pre>
  <p>I've tried ssh'ing, ssm agent appears to be running, it seems from <a href="https://aws.amazon.com/premiumsupport/knowledge-center/systems-manager-ec2-instance-not-appear/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/systems-manager-ec2-instance-not-appear/</a> that IAM roles are misconfigured.</p>
  <p>How can I configure the IAM roles / IAM instance profiles properly to use SSM agent and run commands with it? Or maybe something else is the problem considering the logs?</p>
  <p>Thank you!</p>
  <p>ssh works:</p>
  <pre><code>$ sudo cat /var/log/amazon/ssm/amazon-ssm-agent.log
  
  ubuntu@ip-172-31-28-150:~$ sudo cat /var/log/amazon/ssm/amazon-ssm-agent.log
  2021-10-21 14:43:21 WARN Error adding the directory '/etc/amazon/ssm' to watcher: no such file or directory
  2021-10-21 14:43:21 INFO [amazon-ssm-agent] amazon-ssm-agent - v3.0.529.0
  2021-10-21 14:43:21 INFO [amazon-ssm-agent] OS: linux, Arch: amd64
  2021-10-21 14:43:22 INFO [amazon-ssm-agent] [LongRunningWorkerContainer] [WorkerProvider] Worker ssm-agent-worker is not running, starting worker process
  2021-10-21 14:43:22 INFO [amazon-ssm-agent] [LongRunningWorkerContainer] [WorkerProvider] Worker ssm-agent-worker (pid:1185) started
  2021-10-21 14:43:22 INFO [amazon-ssm-agent] [LongRunningWorkerContainer] Monitor long running worker health every 60 seconds
  2021-10-21 14:43:23 WARN Error adding the directory '/etc/amazon/ssm' to watcher: no such file or directory
  2021-10-21 14:43:23 INFO [ssm-agent-worker] Dial to Core Agent broadcast channel
  2021-10-21 14:43:23 INFO [ssm-agent-worker] Start to listen to Core Agent termination channel
  2021-10-21 14:43:23 INFO [ssm-agent-worker] Dial to Core Agent broadcast channel
  2021-10-21 14:43:23 INFO [ssm-agent-worker] Start to listen to Core Agent health channel
  2021-10-21 14:43:23 INFO [ssm-agent-worker] Create new startup processor
  2021-10-21 14:43:23 INFO [ssm-agent-worker] [StartupProcessor] Executing startup processor tasks
  2021-10-21 14:43:23 INFO [ssm-agent-worker] [StartupProcessor] Write to serial port: Amazon SSM Agent v3.0.529.0 is running
  2021-10-21 14:43:23 INFO [ssm-agent-worker] [StartupProcessor] Write to serial port: OsProductName: Ubuntu
  2021-10-21 14:43:23 INFO [ssm-agent-worker] [StartupProcessor] Write to serial port: OsVersion: 20.04
  2021-10-21 14:43:23 INFO [ssm-agent-worker] Entering SSM Agent hibernate - EC2RoleRequestError: no EC2 instance role found
  caused by: EC2MetadataError: failed to make EC2Metadata request
          status code: 404, request id:
  caused by: &lt;?xml version=&quot;1.0&quot; encoding=&quot;iso-8859-1&quot;?&gt;
  &lt;!DOCTYPE html PUBLIC &quot;-//W3C//DTD XHTML 1.0 Transitional//EN&quot;
          &quot;http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&gt;
  &lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot; xml:lang=&quot;en&quot; lang=&quot;en&quot;&gt;
   &lt;head&gt;
    &lt;title&gt;404 - Not Found&lt;/title&gt;
   &lt;/head&gt;
   &lt;body&gt;
    &lt;h1&gt;404 - Not Found&lt;/h1&gt;
   &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  <pre><code>$ sudo snap services amazon-ssm-agent
  
  Service                            Startup  Current  Notes
  amazon-ssm-agent.amazon-ssm-agent  enabled  active   -
  
  $ sudo systemctl status snap.amazon-ssm-agent.amazon-ssm-agent.service
  
  ● snap.amazon-ssm-agent.amazon-ssm-agent.service - Service for snap application amazon-ssm-agent.amazon-ssm-agent
       Loaded: loaded (/etc/systemd/system/snap.amazon-ssm-agent.amazon-ssm-agent.service; enabled; vendor preset: enabled)
       Active: active (running) since Thu 2021-10-21 14:43:20 UTC; 4min 32s ago
     Main PID: 1153 (amazon-ssm-agen)
        Tasks: 17 (limit: 1160)
       Memory: 94.9M
       CGroup: /system.slice/snap.amazon-ssm-agent.amazon-ssm-agent.service
               ├─1153 /snap/amazon-ssm-agent/3552/amazon-ssm-agent
               └─1185 /snap/amazon-ssm-agent/3552/ssm-agent-worker
  
  Oct 21 14:43:20 ip-172-31-28-150 systemd[1]: Started Service for snap application amazon-ssm-agent.amazon-ssm-agent.
  Oct 21 14:43:21 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: Error occurred fetching the seelog config file path:  open /etc/amazon/ssm/seelog.xml: no such file or directory
  Oct 21 14:43:21 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: Initializing new seelog logger
  Oct 21 14:43:21 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: New Seelog Logger Creation Complete
  Oct 21 14:43:21 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: 2021-10-21 14:43:21 WARN Error adding the directory '/etc/amazon/ssm' to watcher: no such file or directory
  Oct 21 14:43:21 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: 2021-10-21 14:43:21 INFO [amazon-ssm-agent] amazon-ssm-agent - v3.0.529.0
  Oct 21 14:43:21 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: 2021-10-21 14:43:21 INFO [amazon-ssm-agent] OS: linux, Arch: amd64
  Oct 21 14:43:22 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: 2021-10-21 14:43:22 INFO [amazon-ssm-agent] [LongRunningWorkerContainer] [WorkerProvider] Worker ssm-agent-worker is not running, starting worker process
  Oct 21 14:43:22 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: 2021-10-21 14:43:22 INFO [amazon-ssm-agent] [LongRunningWorkerContainer] [WorkerProvider] Worker ssm-agent-worker (pid:1185) started
  Oct 21 14:43:22 ip-172-31-28-150 amazon-ssm-agent.amazon-ssm-agent[1153]: 2021-10-21 14:43:22 INFO [amazon-ssm-agent] [LongRunningWorkerContainer] Monitor long running worker health every 60 seconds
  </code></pre>