aws / aws/aws-toolkit-vscode

"Connect VSCode to EC2 Instance" tries to add policies even if the EC2 instance has the required permissions

Open
#7,204 3 comments 0 reactions 0 assignees View on GitHub
bug remote-execute service:ec2
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

The "Connect VSCode to EC2 Instance" assumes the attached EC2 instance profile of the instance you want to connect to does not have the permissions necessary and attempts to add it to the instance profile. One could have their EC2 instance profile pre-populated with the policies:

- `AmazonSSMManagedEC2InstanceDefaultPolicy`
- `AmazonSSMManagedInstanceCore`

, but the toolkit does not recognize this.

### Current Behavior
In all attempts in using "Connect VSCode to EC2 Instance", VSCode attempts to add the following policies with the modal:

![Image](https://github.com/user-attachments/assets/e1fa959e-e0a1-4249-a176-1971054ea3c2)

### Expected Behavior
There exists an option to disable the above modal and connecting to it will attempt the SSM connection.
If the SSM connection fails, there should be an error message stating the EC2 instance profile is missing IAM permissions.

---
### Related

> To confirm, when you attached the explicit permissions to the EC2 Instance Profile, that worked, but attaching a policy containing the required permissions didn't work?

_Originally posted by @justinmk3 in [#6434](https://github.com/aws/aws-toolkit-vscode/issues/6434#issuecomment-2616961640)_

No this doesn't work unfortunately.

Contributor guide

Open the contributing guide

Research direction

Start with the “Connect VSCode to EC2 Instance” flow and its permissions modal; trace how attached instance-profile policies are checked before the SSM connection. Compare handling of the two named policies, then verify that a failed SSM connection reports missing IAM permissions and that the modal can be bypassed when permissions are present.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript, vscode
Domain
cloud, devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.