SSM RunAs feature request

Hello folks,

A feature should be added to SSM RunAs support.
RunAs enabled, but ssm-user will still be created by the service when you start a session.

Currently:
if you enable it, any user must be created locally.
if you not, when you start a session the service will create the ssm-user with sudo access.

I'm requesting this because if we have RunAs support enabled and new instances are launched the ssm-user should be created locally first or disable the RunAs and start a session in order to allow the service to create ssm-user.

If you have any other advice, please share.

Thank you!

Start by tracing the SSM RunAs and session-start handling for ssm-user creation; the issue does not name files, tests, or entry points. Compare the enabled and disabled RunAs flows across newly launched instances, then define the expected behavior for local user creation and sudo access before identifying tests for both paths.

Written by the indexing model from the issue text.