ssm:GetManifest is a Read access-level action in the ssm service. Grants permission to Systems Manager and SSM Agent to determine package installation requirements for an instance (internal Systems Manager call)
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows ssm:GetManifest. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSsmGetManifest",
"Effect": "Allow",
"Action": "ssm:GetManifest",
"Resource": "*"
}
]
}