title: Assume a role to an external account to access a specific instance of my account as Session Manager
body: <p>I am a beginner studying AWS.</p>
  <p>I'd like to give a role external account B so that It can access my account A.</p>
  <p>I want to use Session Manager(System Manager) to record commands for external accounts.</p>
  <ul>
  <li>My Account ID : A</li>
  <li>External Account ID : B</li>
  </ul>
  <p>So, In my Account A, I made ssm-accoutB-role.</p>
  <p>connected policy is:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;ssm:StartSession&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:ec2:REGION:ACCOUNT-ID_A:instance/*&quot;
              ],
              &quot;Condition&quot;: {
                  &quot;StringLike&quot;: {
                      &quot;ssm:resourceTag/ssm&quot;: [
                          &quot;true&quot;
                      ]
                  }
              }
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;ssm:TerminateSession&quot;,
                  &quot;ssm:ResumeSession&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:ssm:*:*:session/${aws:username}-*&quot;
              ]
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;sts:AssumeRole&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;*&quot;
              ]
          }
      ]
  }
  </code></pre>
  <p>and set the trust relationship with AccountB</p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;arn:aws:iam::ACCOUNT-ID_B:user/IAM-USER&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
        &quot;Condition&quot;: {}
      }
    ]
  }
  
  </code></pre>
  <p>and I attached Role for <code>AmazonSSMManagedInstanceCore</code> policy with Instance.</p>
  <p>Using AWS-CLI, I send commands <code>aws sts get-caller-identity</code>, and export AWS_ACCESS_KEY_ID and so on...
  success to assume Role.</p>
  <p>and <code>aws ssm start-session \ --target instance-id</code></p>
  <p>// This instance in private subnet connected NAT Gateway</p>
  <p>It appears error &quot;An error occurred (AccessDeniedException) when calling the TerminateSession operation: User~~&quot;</p>
  <p>How to set the IAM ROLE for ssm...</p>
  <p>Please help me!</p>