"Connect VSCode to EC2 Instance" tries to add policies even if the EC2 instance has the required permissions
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
The "Connect VSCode to EC2 Instance" assumes the attached EC2 instance profile of the instance you want to connect to does not have the permissions necessary and attempts to add it to the instance profile. One could have their EC2 instance profile pre-populated with the policies:
- `AmazonSSMManagedEC2InstanceDefaultPolicy`
- `AmazonSSMManagedInstanceCore`
, but the toolkit does not recognize this.
### Current Behavior
In all attempts in using "Connect VSCode to EC2 Instance", VSCode attempts to add the following policies with the modal:

### Expected Behavior
There exists an option to disable the above modal and connecting to it will attempt the SSM connection.
If the SSM connection fails, there should be an error message stating the EC2 instance profile is missing IAM permissions.
---
### Related
> To confirm, when you attached the explicit permissions to the EC2 Instance Profile, that worked, but attaching a policy containing the required permissions didn't work?
_Originally posted by @justinmk3 in [#6434](https://github.com/aws/aws-toolkit-vscode/issues/6434#issuecomment-2616961640)_
No this doesn't work unfortunately.
Contributor guide
Research direction
Start with the “Connect VSCode to EC2 Instance” flow and its permissions modal; trace how attached instance-profile policies are checked before the SSM connection. Compare handling of the two named policies, then verify that a failed SSM connection reports missing IAM permissions and that the modal can be bypassed when permissions are present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript, vscode
- Domain
- cloud, devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100