AWS IAM SSM - Restrict Documents that Instances can run
<p>Is there a way to restrict the IAM policy for an EC2 instance s.t. it can only run a short list of Documents - I tried restricting access to ssm:GetDocument like this:</p>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "ssm:GetDocument"
        ],
        "Resource": [
            "arn:aws:ssm:ap-southeast-2:*:document/MyCommand"
        ]
    }
 ]}
</code></pre>

<p>But I can run any command on the instance still including the AWS-RunPowershellScript document.</p>

<p>This link shows how users can be restricted with respect to ssm:sendCommand:
<a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/delegate-commands.html" rel="noreferrer">http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/delegate-commands.html</a> </p>