ssm:UpdateManagedInstancePublicKey is a Write access-level action in the ssm service. Grants permission to SSM Agent to update the public key of the managed node after rotating the key pair (internal Systems Manager call)
ARNs that ssm:UpdateManagedInstancePublicKey can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ssm:UpdateManagedInstancePublicKey.
Filters access by the AWS account ID associated with the managed node making the request. Available only in VPC endpoint policies and service control policies (SCPs)
Filters access by the AWS Organizations ID associated with the managed node making the request. Available only in VPC endpoint policies and service control policies (SCPs)
Filters access by based on a tag key-value pair assigned to the AWS resource
Filters access by a tag key-value pair assigned to the Systems Manager resource
Filters access by based on a tag key-value pair assigned to the Systems Manager resource
A minimal policy that allows ssm:UpdateManagedInstancePublicKey. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSsmUpdateManagedInstancePublicKey",
"Effect": "Allow",
"Action": "ssm:UpdateManagedInstancePublicKey",
"Resource": "*"
}
]
}