| ssm:DescribeAssociation | ReadOnly |
| ssm:DescribeAssociationExecutionTargets | ReadOnly |
| ssm:DescribeAssociationExecutions | ReadOnly |
| ssm:GetDeployablePatchSnapshotForInstance | ReadOnly |
| iam:ListRoles | Metadata |
| ssm-guiconnect:GetConnection | Metadata |
| ssm:DescribeActivations | Metadata |
| ssm:DescribeAutomationExecutions | Metadata |
| ssm:DescribeAutomationStepExecutions | Metadata |
| ssm:DescribeAvailablePatches | Metadata |
| ssm:DescribeDocument | Metadata |
| ssm:DescribeDocumentParameters | Metadata |
| ssm:DescribeDocumentPermission | Metadata |
| ssm:DescribeEffectiveInstanceAssociations | Metadata |
| ssm:DescribeEffectivePatchesForPatchBaseline | Metadata |
| ssm:DescribeInstanceAssociationsStatus | Metadata |
| ssm:DescribeInstanceInformation | Metadata |
| ssm:DescribeInstancePatchStates | Metadata |
| ssm:DescribeInstancePatchStatesForPatchGroup | Metadata |
| ssm:DescribeInstancePatches | Metadata |
| ssm:DescribeInstanceProperties | Metadata |
| ssm:DescribeInventoryDeletions | Metadata |
| ssm:DescribeMaintenanceWindowExecutionTaskInvocations | Metadata |
| ssm:DescribeMaintenanceWindowExecutionTasks | Metadata |
| ssm:DescribeMaintenanceWindowExecutions | Metadata |
| ssm:DescribeMaintenanceWindowSchedule | Metadata |
| ssm:DescribeMaintenanceWindowTargets | Metadata |
| ssm:DescribeMaintenanceWindowTasks | Metadata |
| ssm:DescribeMaintenanceWindows | Metadata |
| ssm:DescribeMaintenanceWindowsForTarget | Metadata |
| ssm:DescribeOpsItems | Metadata |
| ssm:DescribeParameters | Metadata |
| ssm:DescribePatchBaselines | Metadata |
| ssm:DescribePatchGroupState | Metadata |
| ssm:DescribePatchGroups | Metadata |
| ssm:DescribePatchProperties | Metadata |
| ssm:DescribeSessions | Metadata |
| ssm:GetAutomationExecution | Metadata |
| ssm:GetCalendarState | Metadata |
| ssm:GetCommandInvocation | Metadata |
| ssm:GetConnectionStatus | Metadata |
| ssm:GetDefaultPatchBaseline | Metadata |
| ssm:GetDocument | Metadata |
| ssm:GetInventory | Metadata |
| ssm:GetInventorySchema | Metadata |
| ssm:GetMaintenanceWindow | Metadata |
| ssm:GetMaintenanceWindowExecution | Metadata |
| ssm:GetMaintenanceWindowExecutionTask | Metadata |
| ssm:GetMaintenanceWindowExecutionTaskInvocation | Metadata |
| ssm:GetMaintenanceWindowTask | Metadata |
| ssm:GetManifest | Metadata |
| ssm:GetOpsItem | Metadata |
| ssm:GetOpsMetadata | Metadata |
| ssm:GetOpsSummary | Metadata |
| ssm:GetParameter | Metadata |
| ssm:GetParameterHistory | Metadata |
| ssm:GetParameters | Metadata |
| ssm:GetParametersByPath | Metadata |
| ssm:GetPatchBaseline | Metadata |
| ssm:GetPatchBaselineForPatchGroup | Metadata |
| ssm:GetServiceSetting | Metadata |
| ssm:ListAssociationVersions | Metadata |
| ssm:ListAssociations | Metadata |
| ssm:ListCommandInvocations | Metadata |
| ssm:ListCommands | Metadata |
| ssm:ListComplianceItems | Metadata |
| ssm:ListComplianceSummaries | Metadata |
| ssm:ListDocumentMetadataHistory | Metadata |
| ssm:ListDocumentVersions | Metadata |
| ssm:ListDocuments | Metadata |
| ssm:ListInstanceAssociations | Metadata |
| ssm:ListInventoryEntries | Metadata |
| ssm:ListOpsItemEvents | Metadata |
| ssm:ListOpsItemRelatedItems | Metadata |
| ssm:ListOpsMetadata | Metadata |
| ssm:ListResourceComplianceSummaries | Metadata |
| ssm:ListResourceDataSync | Metadata |
| ssm:ListTagsForResource | Metadata |
| ssm:PutConfigurePackageResult | Metadata |
