title: error when using EC2 SNS with SSM (Systems Manager)
body: <p>I'm trying to use AWS's SNS with SSM but getting an error about roles. </p>
  
  <p>Here's the error:</p>
  
  <pre><code>botocore.errorfactory.InvalidRole: An error occurred (InvalidRole) when calling the SendCommand operation: ServiceRoleArn is not valid: arn:aws:iam::&lt;account #&gt;:role/FullSNS
  </code></pre>
  
  <p>Here's the relevant code:</p>
  
  <pre><code>response = client.send_command(
  InstanceIds=[
      '&lt;instance id&gt;',
  ],
  DocumentName='AWS-RunShellScript',
  Parameters={
      'commands': [
          '&lt;command&gt;',
      ],
      'workingDirectory': [
          '&lt;directory&gt;'
      ]
  },
  OutputS3BucketName='&lt;s3 bucket&gt;',
  ServiceRoleArn='arn:aws:iam::&lt;account #&gt;:role/FullSNS',
  NotificationConfig={
      'NotificationArn': 'arn:aws:sns:us-east-1:&lt;account #&gt;:MyTestTopic',
      'NotificationEvents': [
          'All',
          ],
      'NotificationType': 'Command'
      }
  )
  </code></pre>
  
  <p>And here's the policy on that role:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
  {
    "Action": [
      "sns:*"
    ],
    "Effect": "Allow",
    "Resource": "*"
  }
  ]
  }
  </code></pre>
  
  <p>The above is with boto3 but I get the same error if I try it within the console.</p>