title: AWS SSM DOcument Assume Role is unable to be assumed for Service Catalog
body: <p>I am using Service Catalog to execute the SSM Automation Document, so my Service Catalog has its own Role called &quot;My_END_USER_Role&quot;, and I've created another role with permission to stop the EC2 for SSM Automation Document.</p>
  <p><strong>My_END_USER_Role</strong> this roles has the <strong>AWSServiceCatalogEndUserFullAccess</strong>, the easy solution is to give this role directly the permission that I need but I do not want the user out of the Service Catalog do any action like stop EC2, so I want to assume <strong>MY_SSM_ROLE</strong> with extra permission, but I get this error</p>
  <pre><code>An error occurred (InvalidAutomationExecutionParametersException) when calling the StartAutomationExecution operation: The defined assume role is unable to be assumed.
  </code></pre>
  <p>base on <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-troubleshooting.html" rel="nofollow noreferrer">AWS Troubleshooting - section Assume Role Can't Be Assumed</a> either is role not existed which cannot be true for me or The assume role doesn't have a trust relationship with the Systems Manager service, now I am stuck here how should I give the trust relationship!!?</p>
  <p>SSM Automation Document</p>
  <pre><code>description: Stop EC2 Instance
  schemaVersion: '0.3'
  assumeRole: '{{ AutomationAssumeRole }}'
  parameters:
    AutomationAssumeRole:
      type: String
      default: 'arn:aws:iam::ACCOUNTID:role/MY_SSM_ROLE'
      description: The ARN of the role that allows Automation to perform the actions on your behalf.
    InstanceId:
      type: 'AWS::EC2::Instance::Id'
  mainSteps:
    - name: StopInstance
      action: 'aws:changeInstanceState'
      inputs:
        InstanceIds:
          - '{{ InstanceId }}'
        DesiredState: stopped
  </code></pre>
  <p>just for a test I gave <strong>MY_SSM_ROLE</strong> the admin permission and also includes this policy:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;sts:AssumeRole&quot;,
                  &quot;iam:PassRole&quot;,
                  &quot;ssm:StartAutomationExecution&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>