| ec2messages:AcknowledgeMessage | Admin |
| ec2messages:DeleteMessage | Admin |
| ec2messages:FailMessage | Admin |
| ec2messages:GetEndpoint | Admin |
| ec2messages:GetMessages | Admin |
| ec2messages:SendReply | Admin |
| iam:PassRole | Admin |
| ssm:AssociateOpsItemRelatedItem | Admin |
| ssm:CreateActivation | Admin |
| ssm:CreateDocument | Admin |
| ssm:CreateMaintenanceWindow | Admin |
| ssm:CreateOpsItem | Admin |
| ssm:CreateOpsMetadata | Admin |
| ssm:CreatePatchBaseline | Admin |
| ssm:CreateResourceDataSync | Admin |
| ssm:DeleteActivation | Admin |
| ssm:DeleteDocument | Admin |
| ssm:DeleteInventory | Admin |
| ssm:DeleteMaintenanceWindow | Admin |
| ssm:DeleteOpsMetadata | Admin |
| ssm:DeletePatchBaseline | Admin |
| ssm:DeleteResourceDataSync | Admin |
| ssm:DeregisterPatchBaselineForPatchGroup | Admin |
| ssm:DisassociateOpsItemRelatedItem | Admin |
| ssm:ModifyDocumentPermission | Admin |
| ssm:PutComplianceItems | Admin |
| ssm:PutParameter | Admin |
| ssm:RegisterDefaultPatchBaseline | Admin |
| ssm:RegisterManagedInstance | Admin |
| ssm:RegisterPatchBaselineForPatchGroup | Admin |
| ssm:ResetServiceSetting | Admin |
| ssm:ResumeSession | Admin |
| ssm:StartChangeRequestExecution | Admin |
| ssm:StartSession | Admin |
| ssm:TerminateSession | Admin |
| ssm:UnlabelParameterVersion | Admin |
| ssm:UpdateDocument | Admin |
| ssm:UpdateDocumentDefaultVersion | Admin |
| ssm:UpdateDocumentMetadata | Admin |
| ssm:UpdateMaintenanceWindow | Admin |
| ssm:UpdateManagedInstanceRole | Admin |
| ssm:UpdateOpsItem | Admin |
| ssm:UpdateOpsMetadata | Admin |
| ssm:UpdatePatchBaseline | Admin |
| ssm:UpdateResourceDataSync | Admin |
| ssm:UpdateServiceSetting | Admin |
| ssmmessages:CreateControlChannel | Admin |
| ssmmessages:CreateDataChannel | Admin |
| ssmmessages:OpenControlChannel | Admin |
| ssmmessages:OpenDataChannel | Admin |
| ssm-guiconnect:CancelConnection | Operator |
| ssm-guiconnect:StartConnection | Operator |
| ssm:AddTagsToResource | Operator |
| ssm:CancelCommand | Operator |
| ssm:CancelMaintenanceWindowExecution | Operator |
| ssm:CreateAssociation | Operator |
| ssm:CreateAssociationBatch | Operator |
| ssm:DeleteAssociation | Operator |
| ssm:DeleteParameter | Operator |
| ssm:DeleteParameters | Operator |
| ssm:DeregisterManagedInstance | Operator |
| ssm:DeregisterTargetFromMaintenanceWindow | Operator |
| ssm:DeregisterTaskFromMaintenanceWindow | Operator |
| ssm:LabelParameterVersion | Operator |
| ssm:PutInventory | Operator |
| ssm:RegisterTargetWithMaintenanceWindow | Operator |
| ssm:RegisterTaskWithMaintenanceWindow | Operator |
| ssm:RemoveTagsFromResource | Operator |
| ssm:SendAutomationSignal | Operator |
| ssm:SendCommand | Operator |
| ssm:StartAssociationsOnce | Operator |
| ssm:StartAutomationExecution | Operator |
| ssm:StopAutomationExecution | Operator |
| ssm:UpdateAssociation | Operator |
| ssm:UpdateAssociationStatus | Operator |
| ssm:UpdateInstanceAssociationStatus | Operator |
| ssm:UpdateInstanceInformation | Operator |
| ssm:UpdateMaintenanceWindowTarget | Operator |
| ssm:UpdateMaintenanceWindowTask | Operator |
| ssm:DescribeAssociation | ReadOnly |
| ssm:DescribeAssociationExecutionTargets | ReadOnly |
| ssm:DescribeAssociationExecutions | ReadOnly |
| ssm:GetDeployablePatchSnapshotForInstance | ReadOnly |
| iam:ListRoles | Metadata |
| ssm-guiconnect:GetConnection | Metadata |
| ssm:DescribeActivations | Metadata |
| ssm:DescribeAutomationExecutions | Metadata |
| ssm:DescribeAutomationStepExecutions | Metadata |
| ssm:DescribeAvailablePatches | Metadata |
| ssm:DescribeDocument | Metadata |
| ssm:DescribeDocumentParameters | Metadata |
| ssm:DescribeDocumentPermission | Metadata |
| ssm:DescribeEffectiveInstanceAssociations | Metadata |
| ssm:DescribeEffectivePatchesForPatchBaseline | Metadata |
| ssm:DescribeInstanceAssociationsStatus | Metadata |
| ssm:DescribeInstanceInformation | Metadata |
| ssm:DescribeInstancePatchStates | Metadata |
| ssm:DescribeInstancePatchStatesForPatchGroup | Metadata |
| ssm:DescribeInstancePatches | Metadata |
| ssm:DescribeInstanceProperties | Metadata |
| ssm:DescribeInventoryDeletions | Metadata |
| ssm:DescribeMaintenanceWindowExecutionTaskInvocations | Metadata |
| ssm:DescribeMaintenanceWindowExecutionTasks | Metadata |
| ssm:DescribeMaintenanceWindowExecutions | Metadata |
| ssm:DescribeMaintenanceWindowSchedule | Metadata |
| ssm:DescribeMaintenanceWindowTargets | Metadata |
| ssm:DescribeMaintenanceWindowTasks | Metadata |
| ssm:DescribeMaintenanceWindows | Metadata |
| ssm:DescribeMaintenanceWindowsForTarget | Metadata |
| ssm:DescribeOpsItems | Metadata |
| ssm:DescribeParameters | Metadata |
| ssm:DescribePatchBaselines | Metadata |
| ssm:DescribePatchGroupState | Metadata |
| ssm:DescribePatchGroups | Metadata |
| ssm:DescribePatchProperties | Metadata |
| ssm:DescribeSessions | Metadata |
| ssm:GetAutomationExecution | Metadata |
| ssm:GetCalendarState | Metadata |
| ssm:GetCommandInvocation | Metadata |
| ssm:GetConnectionStatus | Metadata |
| ssm:GetDefaultPatchBaseline | Metadata |
| ssm:GetDocument | Metadata |
| ssm:GetInventory | Metadata |
| ssm:GetInventorySchema | Metadata |
| ssm:GetMaintenanceWindow | Metadata |
| ssm:GetMaintenanceWindowExecution | Metadata |
| ssm:GetMaintenanceWindowExecutionTask | Metadata |
| ssm:GetMaintenanceWindowExecutionTaskInvocation | Metadata |
| ssm:GetMaintenanceWindowTask | Metadata |
| ssm:GetManifest | Metadata |
| ssm:GetOpsItem | Metadata |
| ssm:GetOpsMetadata | Metadata |
| ssm:GetOpsSummary | Metadata |
| ssm:GetParameter | Metadata |
| ssm:GetParameterHistory | Metadata |
| ssm:GetParameters | Metadata |
| ssm:GetParametersByPath | Metadata |
| ssm:GetPatchBaseline | Metadata |
| ssm:GetPatchBaselineForPatchGroup | Metadata |
| ssm:GetServiceSetting | Metadata |
| ssm:ListAssociationVersions | Metadata |
| ssm:ListAssociations | Metadata |
| ssm:ListCommandInvocations | Metadata |
| ssm:ListCommands | Metadata |
| ssm:ListComplianceItems | Metadata |
| ssm:ListComplianceSummaries | Metadata |
| ssm:ListDocumentMetadataHistory | Metadata |
| ssm:ListDocumentVersions | Metadata |
| ssm:ListDocuments | Metadata |
| ssm:ListInstanceAssociations | Metadata |
| ssm:ListInventoryEntries | Metadata |
| ssm:ListOpsItemEvents | Metadata |
| ssm:ListOpsItemRelatedItems | Metadata |
| ssm:ListOpsMetadata | Metadata |
| ssm:ListResourceComplianceSummaries | Metadata |
| ssm:ListResourceDataSync | Metadata |
| ssm:ListTagsForResource | Metadata |
| ssm:PutConfigurePackageResult | Metadata |
