aws ssm session - how do I set "runAsDefaultuser" to be a interactive parameter when starting a session

1k views Asked by At

I'm trying to create a document that I call and specific my IAM user as the user to connect with. This document will be a shared document that has a parameter "runAsDefaultuser". It will default to a user that doesn't exist. This will force me to provide an argument like, --parameters '{"runAsDefaultUser": ["joeschmo"]}'.

My end goal is to allow users to login in as their IAM user via CLI through SSM. I've tried using tag's in the IAM user account. That only works when using a SSM session over the Web UI in the AWS Session Manager page. Doesn't work vi SSM CLI. The SSM documents override this.

I can't set this as a parameter. It will only accept it as a hardcoded value. Same with "runAsEnabled".

I get this error when I try to set it as a parameter using the "aws ssm update-document or create-document command.

An error occurred (InvalidDocumentContent) when calling the UpdateDocument operation: DefaultUser: {{runAsDefaultUser}} is invalid

I'm using this page as a reference. https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-preferences-cli.html

Here is the example document that I am using.

{
   "schemaVersion":"1.0",
   "description":"Session Document Parameter Example JSON Template",
   "sessionType":"Standard_Stream",
   "parameters":{
      "s3BucketName":{
         "type":"String",
         "default":""
      },
      "s3KeyPrefix":{
         "type":"String",
         "default":""
      },
      "s3EncryptionEnabled":{
         "type":"String",
         "default":"false"
      },
      "cloudWatchLogGroupName":{
         "type":"String",
         "default":""
      },
      "cloudWatchEncryptionEnabled":{
         "type":"String",
         "default":"false"
      },
      "runAsDefaultUser":{
         "type":"String",
         "default":"nobody"
      }
   },
   "inputs":{
      "s3BucketName":"{{s3BucketName}}",
      "s3KeyPrefix":"{{s3KeyPrefix}}",
      "s3EncryptionEnabled":"{{s3EncryptionEnabled}}",
      "cloudWatchLogGroupName":"{{cloudWatchLogGroupName}}",
      "cloudWatchEncryptionEnabled":"{{cloudWatchEncryptionEnabled}}",
      "kmsKeyId":"",
      "runAsEnabled": true
      "runAsDefaultUser":"{{runAsDefaultUser}}",
      "shellProfile": {
        "windows": "",
        "linux": "bash"
      }
   }
}

The command that I want to use:

aws ssm start-session --target i-ThisIsObviouslyMadeUp \
--document-name Custom-SessionManagerRunShell \
--parameters '{"runAsDefaultUser": ["joeschmo"]}'
0

There are 0 answers