マルチAZ冗長設計にAWS SSM Start Sessionを組み込むIAM設計｜クロスアカウント権限設計

この記事のポイント

・aws ssm start-session は踏み台なしでプライベートサブネットのEC2に接続できる
・マルチAZ構成では全AZのEC2に同じIAMインスタンスプロファイルを付けるのが基本設計
・クロスアカウント接続はExternalId付き信頼ポリシーとSTSロール引き受けで実現する
・プライベートサブネットにはssm・ssmmessages・ec2messagesの3エンドポイントが必要

# Session Manager PluginをRPMでインストール（Amazon Linux 2023 / RHEL9）
$ curl "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/linux_64bit/session-manager-plugin.rpm"   -o "/tmp/session-manager-plugin.rpm"
$ sudo dnf install -y /tmp/session-manager-plugin.rpm

# インストール確認
$ session-manager-plugin --version
1.2.677.0

# EC2インスタンス内でSSM Agentの状態を確認
$ sudo systemctl status amazon-ssm-agent

* amazon-ssm-agent.service - amazon-ssm-agent
     Loaded: loaded (/usr/lib/systemd/system/amazon-ssm-agent.service; enabled)
     Active: active (running) since Mon 2026-09-14 09:00:00 UTC; 3 weeks ago
   Main PID: 1105 (amazon-ssm-agent)
      Tasks: 10 (limit: 4600)
     Memory: 42.3M

$ sudo systemctl start amazon-ssm-agent
$ sudo systemctl enable amazon-ssm-agent

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartSession",
        "ssm:TerminateSession",
        "ssm:DescribeSessions",
        "ssm:GetConnectionStatus"
      ],
      "Resource": [
        "arn:aws:ec2:ap-northeast-1:111122223333:instance/*",
        "arn:aws:ssm:ap-northeast-1:111122223333:session/${aws:username}-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ssm:DescribeInstanceInformation"
      ],
      "Resource": "*"
    }
  ]
}

# インスタンスIDを指定してセッションを開始（ap-northeast-1・AZ-aのインスタンス）
$ aws ssm start-session   --target i-0a1b2c3d4e5f67890   --region ap-northeast-1

Starting session with SessionId: operator01-0123456789abcdef0
$ whoami
ssm-user
$ hostname
ip-10-0-1-101.ap-northeast-1.compute.internal
$ exit

Exiting session with sessionId: operator01-0123456789abcdef0.

# AZ-cのインスタンスにも同じコマンドで接続可能（踏み台経由不要）
$ aws ssm start-session   --target i-0f9e8d7c6b5a43210   --region ap-northeast-1

Starting session with SessionId: operator01-abcdef0123456789
$ hostname
ip-10-0-3-202.ap-northeast-1.compute.internal

# アカウントBのIAMロール「SSMCrossAccountRole」の信頼ポリシー
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "ssm-crossaccount-prod-2026"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartSession",
        "ssm:TerminateSession",
        "ssm:DescribeSessions",
        "ssm:GetConnectionStatus",
        "ssm:DescribeInstanceInformation",
        "ec2:DescribeInstances"
      ],
      "Resource": "*"
    }
  ]
}

# アカウントAのIAMポリシー（アカウントBのSSMCrossAccountRoleを引き受ける権限）
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::444455556666:role/SSMCrossAccountRole"
    }
  ]
}

# ~/.aws/config にクロスアカウントプロファイルを登録
[profile account-b-prod]
role_arn = arn:aws:iam::444455556666:role/SSMCrossAccountRole
source_profile = default
external_id = ssm-crossaccount-prod-2026
region = ap-northeast-1

# プロファイルを指定してSSMセッションを開始
$ aws ssm start-session   --target i-0a1b2c3d4e5f67890   --profile account-b-prod

Starting session with SessionId: operator01-cafebabe12345678
$ hostname
ip-10-1-2-150.ap-northeast-1.compute.internal
$ exit

Exiting session with sessionId: operator01-cafebabe12345678.

# IAMポリシーシミュレーターで権限を確認
$ aws iam simulate-principal-policy   --policy-source-arn arn:aws:iam::111122223333:user/operator01   --action-names ssm:StartSession   --resource-arns arn:aws:ec2:ap-northeast-1:111122223333:instance/i-0a1b2c3d4e5f67890

{
    "EvaluationResults": [
        {
            "EvalActionName": "ssm:StartSession",
            "EvalDecision": "explicitDeny",
            ...
        }
    ]
}

SessionManagerPlugin is not found. Please refer to SessionManager Documentation here:
http://docs.aws.amazon.com/console/systems-manager/session-manager-plugin-not-found