ssmmessages:CreateControlChannel is a Write access-level action in the ssmmessages service. Grants permission to register a control channel for an instance to send control messages to Systems Manager service
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants ssmmessages:CreateControlChannel.
Filters access by the ARN of the instance from which the request originated
Filters access by verifying the Amazon Resource Name (ARN) of the AWS Systems Manager's managed instance from which the request is made. This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile
A minimal policy that allows ssmmessages:CreateControlChannel. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSsmmessagesCreateControlChannel",
"Effect": "Allow",
"Action": "ssmmessages:CreateControlChannel",
"Resource": "*"
}
]
}