Monitoring Systems Manager status changes using Amazon SNS notifications

Open the IAM console at https://console.aws.amazon.com/iam/.

In the navigation pane, choose Policies, and then choose Create Policy. (If a Get Started button is shown, choose it, and then choose Create Policy.)

Choose the JSON tab.

Replace the default content with the following.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "arn:aws:sns:region:account-id:sns-topic-name"
        }
    ]
}

region represents the identifier for an AWS Region supported by AWS Systems Manager, such as us-east-2 for the US East (Ohio) Region. For a list of supported region values, see the Region column in Systems Manager service endpoints in the Amazon Web Services General Reference.

account-id represents the 12-digit identifier for your AWS account, in the format 123456789012.

sns-topic-name represents the name of the Amazon SNS topic you want to use for publishing notifications.

Choose Next: Tags.

(Optional) Add one or more tag-key value pairs to organize, track, or control access for this policy.

Choose Next: Review.

On the Review policy page, for Name, enter a name for the inline policy. For example: my-sns-publish-permissions.

(Optional) For Description, enter a description for the policy.

Choose Create policy.

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

In the navigation pane of the IAM console, choose Roles, and then choose Create role.

Choose the AWS service role type, and then choose Systems Manager.

Choose the Systems Manager use case. Then, choose Next.

On the Attach permissions policies page, select the box to the left of the name of the custom policy you created in Task 2. For example: my-sns-publish-permissions.

(Optional) Set a permissions boundary. This is an advanced feature that is available for service roles, but not service-linked roles.

Expand the Permissions boundary section and choose Use a permissions boundary to control the maximum role permissions. IAM includes a list of the AWS managed and customer managed policies in your account. Select the policy to use for the permissions boundary or choose Create policy to open a new browser tab and create a new policy from scratch. For more information, see Creating IAM policies in the IAM User Guide. After you create the policy, close that tab and return to your original tab to select the policy to use for the permissions boundary.

Choose Next.

If possible, enter a role name or role name suffix to help you identify the purpose of this role. Role names must be unique within your AWS account. They are not distinguished by case. For example, you cannot create roles named both PRODROLE and prodrole. Because various entities might reference the role, you cannot edit the name of the role after it has been created.

(Optional) For Description, enter a description for the new role.

Choose Edit in the Step 1: Select trusted entities or Step 2: Select permissions sections to edit the use cases and permissions for the role.

(Optional) Add metadata to the user by attaching tags as key-value pairs. For more information about using tags in IAM, see Tagging IAM resources in the IAM User Guide.

Review the role and then choose Create role.

Choose the name of the role, and then copy or make a note of the Role ARN value. This Amazon Resource Name (ARN) for the role is used when you send a command that is configured to return Amazon SNS notifications.

Keep the Summary page open.

In the IAM navigation pane, choose Users, and then choose the user account that you want to configure.

On the Permissions tab, in the policies list, verify that either the AmazonSSMFullAccess policy is listed or that there is a comparable policy that gives the account permissions to access Systems Manager.

Choose Add inline policy.

On the Create policy page, choose the Visual editor tab.

Choose Choose a service, and then choose IAM.

For Actions, in the Filter actions text box, enter PassRole, and then select the check box next to PassRole.

For Resources, verify that Specific is selected, and then choose Add ARN.

In the Specify ARN for role field, paste the Amazon SNS IAM role ARN that you copied at the end of Task 3. The system automatically populates the Account and Role name with path fields.

Choose Add.

Choose Review policy.

On the Review Policy page, enter a name and then choose Create policy.

Open the IAM console at https://console.aws.amazon.com/iam/.

In the navigation pane, choose Roles and select the Amazon SNS IAM role created in Task 3.

Copy or make a note of the Role ARN and return to the Roles section of the IAM console.

Select the custom Maintenance Windows service role you created from the Role name list.

On the Permissions tab, verify that either the AmazonSSMMaintenanceWindowRole policy is listed or there is a comparable policy that gives maintenance windows permission to the Systems Manager API. If it is not, choose Add permissions, Attach policies to attach it.

Choose Add permissions, Create inline policy.

Choose the Visual editor tab.

For Service, choose IAM.

For Actions, in the Filter actions text box, enter PassRole, and then select the check box next to PassRole.

For Resources, choose Specific, and then choose Add ARN.

In the Specify ARN for role box, paste the ARN of the Amazon SNS IAM role created in Task 3, and then choose Add.

Choose Review policy.

On the Review policy page, specify a name for the PassRole policy, and then choose Create policy.