aws ssm start-session incorrectly returns permissions error when session-manager-plugin is not installed
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the bug
When attempting to use the `aws ssm start-session` command without having the session manager plugin is installed and without ssm:TerminateSession action permission, an AccessDeniedException is thrown. Only after the permission is granted is the correct exception is raised (notifying that the plugin needs to be installed).
This is a bug because `aws ssm start-session` command does not require this permission, and can be run without it.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Expected Behavior
When attempting to run `aws ssm start-session` without ssm:TerminateSession permissions and without the session manager plugin installed, the correct error should print to the console (i.e., "SessionManagerPlugin is not found.")
### Current Behavior
When attempting tun run `aws ssm start-session` without ssm:TerminateSession permissions and without the session manager plugin installed, an AccessDeniedException is raised and printed to the console.
### Reproduction Steps
Using aws-cli tool without plugin manager installed and without ssm:TerminateSession permissions for your current IAM user/role, attempt to use `aws ssm start-session` to start a session. [More about using this command in the documentation.](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-start-cli)
### Possible Solution
_No response_
### Additional Information/Context
While it may seem obvious that any command prefixed with `aws ssm` would require the session manager plugin, it is far less obvious if this command is buried in a script or run using other tools. It falsely reports that permission scope needs to be expanded to perform an action when it does not. Many tools use ssm as a backend method and it may not be clearly obvious why these scripts or tools are failing.
### CLI version used
aws-cli/2.31.31
### Environment details (OS name and version, etc.)
macOS Sequoia 15.7.2
Contributor guide
Assessment
This issue has not been assessed yet.