aws / aws/aws-cli

aws ssm start-session incorrectly returns permissions error when session-manager-plugin is not installed

Open
#9,837 2 comments 0 reactions 1 assignee Claimed by @RyanFitzSimmonsAK View on GitHub
bug p3 ssm
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

When attempting to use the `aws ssm start-session` command without having the session manager plugin is installed and without ssm:TerminateSession action permission, an AccessDeniedException is thrown. Only after the permission is granted is the correct exception is raised (notifying that the plugin needs to be installed).

This is a bug because `aws ssm start-session` command does not require this permission, and can be run without it.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

When attempting to run `aws ssm start-session` without ssm:TerminateSession permissions and without the session manager plugin installed, the correct error should print to the console (i.e., "SessionManagerPlugin is not found.")

### Current Behavior

When attempting tun run `aws ssm start-session` without ssm:TerminateSession permissions and without the session manager plugin installed, an AccessDeniedException is raised and printed to the console.

### Reproduction Steps

Using aws-cli tool without plugin manager installed and without ssm:TerminateSession permissions for your current IAM user/role, attempt to use `aws ssm start-session` to start a session. [More about using this command in the documentation.](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-start-cli)

### Possible Solution

_No response_

### Additional Information/Context

While it may seem obvious that any command prefixed with `aws ssm` would require the session manager plugin, it is far less obvious if this command is buried in a script or run using other tools. It falsely reports that permission scope needs to be expanded to perform an action when it does not. Many tools use ssm as a backend method and it may not be clearly obvious why these scripts or tools are failing.

### CLI version used

aws-cli/2.31.31

### Environment details (OS name and version, etc.)

macOS Sequoia 15.7.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.