Amazon-ssm-agent: Unable to start a new session as ssm-user with runAS option

[ppieprzycki]

Without "run as" option the "ssm-user" is created during the first session. If I configure SSM and set "run as" and as default user use "ssm-user" I'm unable to login into new vm's.
I get an error "Unable to start shell: failed to start pty since RunAs user ssm-user does not exist"

Please let me know if such as PR will resolve this issue
https://github.com/ppieprzycki/amazon-ssm-agent/commit/0964467ada738e855fd6f41a15a1ac928aed3186

Regards
Piotr Pieprzycki

[sumohite]

Thank you for reaching out. Which version of the agent are you using? Could you try updating it to the latest version?

[tcharewicz]

Hello,

You can reproduce this problem by running ec2 from Ubuntu 18.04 AMI ( The agent is in version 2.3.672.0 ). I have updated this agent to the latest version, 2.3.758.0, and the problem persists.

Preference of session manager looks like that:
{
"schemaVersion": "1.0",
"description": "Document to hold regional settings for Session Manager",
"sessionType": "Standard_Stream",
"inputs": {
"s3BucketName": "some-bucket-foo",
"s3KeyPrefix": "account_id",
"s3EncryptionEnabled": true,
"cloudWatchLogGroupName": "",
"cloudWatchEncryptionEnabled": true,
"kmsKeyId": "",
"runAsEnabled": true,
"runAsDefaultUser": "ssm-user"
}
}

--
regards
TomekC

[sruthi-maddineni]

To use runAs with session manager, the username specified has to be an existing user. Agent will not attempt to create the user when runAs is enabled. Let us know if you have any other questions.

[tcharewicz]

If I understand correctly that I am using the default user for SSM, which I cannot use after starting the instance. It's weird. It's a security feature? For what?

[Wenzil]

@sruthi-maddineni Would it be possible in the future to allow that runAs user to be created automatically?

Any recommendations otherwise on how to automate the creation of OS users corresponding to the list of IAM users with permission to start sessions on a given set of instances? I am new to SSM so sorry if this is obvious!

[nitikaaws]

Thanks for your feedback! Session Manager do not support automatic creation of configured Run As user and this user creation should be handled separately before staring a session. Let us know in case of further queries.

[gurpalw]

But why doesn't it support it?

It seems a bit strange that it will create the ssm-user when Run As is disabled, but if it is enabled, and the role attempting to connect has the tag to use the user ssm-user that it won't create the user.

Seems odd.

My use case:

Have some users tagged with SSMSessionRunAs = "ssm-user" so that they have root permissions when they create a session. We want this because only certain people should have root access via ssm.

If the user is not tagged with that, then connect with the (non root) user defined in the "General Preferences" of the Session Manager in the aws console.