'AWS System Manager GetParameters permission being implicitly denied

I am trying to setup eksctl for eks but it throwing "Error: unable to determine AMI to use: error getting AMI from SSM Parameter Store: AccessDeniedException: User: arn:aws:iam:::user/cnc is not authorized to perform: ssm:GetParameter on resource: arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.18/amazon-linux-2/recommended/image_id".

The IAM Permission Policy I am using is

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeParameters"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameters",
                "ssm:GetParametersByPath"
            ],
            "Resource": "arn:aws:ssm:::parameter/*"
        }
    ]

I also tried using policy simulation for check the permissions , it is giving me "Implicitly Denied (No matching statement)"

Solution 1:^[1]

I had the same issue. The way I resolved it was by adding the region to the ssm resource. And also added a ssm:GetParameter like this:

"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action":[
            "ssm:DescribeParameters"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action":[
            "ssm:GetParameters",
            "ssm:GetParameter",
            "ssm:GetParametersByPath"
        ],
        "Resource": "arn:aws:ssm:ca-central-1::parameter/*"
    }
]

If you notice I've added the region ca-central-1 and you should change it to your current region.

Solution 2:^[2]

I think you might need to authorize the "ssm:GetParameter" action as well.

Solution 3:^[3]

Mine was in the other direction. I had ssm:GetParameter, and the error message was AccessDeniedException: User is not authorized to perform: ssm:GetParameter on resource because no identity-based policy allows the ssm:GetParameter action, but implicitly the missing ssm:GetParameters was causing the request to be denied with a misleading error message.

Solution 4:^[4]

I had the same error message as @plantbeard but mine was related to capitalisation I was using Serverless and taking the param name from the stage enviroment eg dev but my parameter was called /Dev/param renaming to /dev/param fixed it for me

Solution 5:^[5]

For me, I was using --with-decryption for a SecureString. My Instance Profile also needed to have KMS rights to the alias/parameter-store-key

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter*"
            ],
            "Resource": "arn:aws:ssm:us-west-2:111122223333:parameter/ITParameters/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
        }
    ]
}

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1	Juan Montufar
Solution 2	Paschen
Solution 3	plantbeard
Solution 4	user6436252
Solution 5	Duke

'AWS System Manager GetParameters permission being implicitly denied

Solution 1:[1]

Solution 2:[2]

Solution 3:[3]

Solution 4:[4]

Solution 5:[5]