title: IAM role is not authorized to perform ec2messages:GetMessages
body: <p>I've created a role with an attached Policy &quot;AmazonSSMManagedInstanceCore&quot;:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;ssm:DescribeAssociation&quot;,
                  &quot;ssm:GetDeployablePatchSnapshotForInstance&quot;,
                  &quot;ssm:GetDocument&quot;,
                  &quot;ssm:DescribeDocument&quot;,
                  &quot;ssm:GetManifest&quot;,
                  &quot;ssm:GetParameter&quot;,
                  &quot;ssm:GetParameters&quot;,
                  &quot;ssm:ListAssociations&quot;,
                  &quot;ssm:ListInstanceAssociations&quot;,
                  &quot;ssm:PutInventory&quot;,
                  &quot;ssm:PutComplianceItems&quot;,
                  &quot;ssm:PutConfigurePackageResult&quot;,
                  &quot;ssm:UpdateAssociationStatus&quot;,
                  &quot;ssm:UpdateInstanceAssociationStatus&quot;,
                  &quot;ssm:UpdateInstanceInformation&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;ssmmessages:CreateControlChannel&quot;,
                  &quot;ssmmessages:CreateDataChannel&quot;,
                  &quot;ssmmessages:OpenControlChannel&quot;,
                  &quot;ssmmessages:OpenDataChannel&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;ec2messages:AcknowledgeMessage&quot;,
                  &quot;ec2messages:DeleteMessage&quot;,
                  &quot;ec2messages:FailMessage&quot;,
                  &quot;ec2messages:GetEndpoint&quot;,
                  &quot;ec2messages:GetMessages&quot;,
                  &quot;ec2messages:SendReply&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>And Trust relationships:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
              },
              &quot;Action&quot;: &quot;sts:AssumeRole&quot;
          }
      ]
  }
  </code></pre>
  <p>I've then attached the IAM role to the instance. When I start the SSM agent in the instance I get the following error:</p>
  <pre><code>2022-03-16 23:14:49 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessageService] [MDSInteractor] error when calling AWS APIs. error details - GetMessages Error: AccessDeniedException: User: arn:aws:sts::XXXX:assumed-role/SSMandCloudWatch/i-YYYYY is not authorized to perform: ec2messages:GetMessages on resource: arn:aws:ssm:eu-central-1:XXXX:* with an explicit deny in a service control policy
          status code: 400, request id: zzzz
  </code></pre>
  <p>The call it's complaining about is explicitly allowed in the policy. I've tried restarting the agent but didn't make any difference.</p>