title: Call an SSM document from terraform
body: <p>I was wondering if anyone could help with this issue? I'm trying to call an SSM document using terraform to stop an ec2 instance. But, it doesn't seems to work. I keep having the error:</p>
  <pre><code>Automation Step Execution fails when it is changing the state of each instance. Get Exception from StopInstances API of ec2 Service. Exception Message from StopInstances API: [You are not authorized to perform this operation. 
  </code></pre>
  <p>Any suggestion here?</p>
  <p>As you could see, there are the right roles. I pass it in parameter.</p>
  <pre><code>provider &quot;aws&quot; {
    profile = &quot;profile&quot;
    region  = &quot;eu-west-1&quot;
  }
  
  
  data &quot;aws_ssm_document&quot; &quot;stop_ec2_doc&quot; {
    name            = &quot;AWS-StopEC2Instance&quot;
    document_format = &quot;JSON&quot;
  }
  
  
  data &quot;aws_iam_policy_document&quot; &quot;assume_role&quot; {
    version = &quot;2012-10-17&quot;
  
    statement {
      sid     = &quot;EC2AssumeRole&quot;
      effect  = &quot;Allow&quot;
      actions = [&quot;sts:AssumeRole&quot;]
  
      principals {
        identifiers = [&quot;ec2.amazonaws.com&quot;]
        type        = &quot;Service&quot;
      }
  
      principals {
        identifiers = [&quot;ssm.amazonaws.com&quot;]
        type        = &quot;Service&quot;
      }
    }
  }
  
  data &quot;aws_ami&quot; &quot;latest_amazon_2&quot; {
    most_recent = true
    owners      = [&quot;amazon&quot;]
    name_regex = &quot;^amzn2-ami-hvm-.*x86_64-gp2&quot;
  }
  
  
  #
  resource &quot;aws_iam_role&quot; &quot;iam_assume_role&quot; {
    name                 = &quot;iam_assume_role&quot;
    assume_role_policy   = data.aws_iam_policy_document.assume_role.json
  }
  
  # 
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;role_1&quot; {
    role       = aws_iam_role.iam_assume_role.name
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore&quot;
  }
  
  # the instance profile
  resource &quot;aws_iam_instance_profile&quot; &quot;iam_instance_profile&quot; {
    name = &quot;iam_instance_profile&quot;
    role = aws_iam_role.iam_assume_role.name
  }
  
  # amazon ec2 instances
  resource &quot;aws_instance&quot; &quot;ec2_instances&quot; {
    count                = 2
    ami                  = data.aws_ami.latest_amazon_2.id
    instance_type        = &quot;t2.micro&quot;
    subnet_id            = &quot;subnet-12345678901&quot;
    iam_instance_profile = aws_iam_instance_profile.iam_instance_profile.name
  
    root_block_device {
      volume_size = 8
      volume_type = &quot;gp2&quot;
  
      delete_on_termination = true
    }
  }
  
  
  resource &quot;aws_ssm_association&quot; &quot;example&quot; {
    name = data.aws_ssm_document.stop_ec2_doc.name
    
    parameters = {
      AutomationAssumeRole = &quot;arn:aws:iam::12345678901:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM&quot;
      InstanceId = aws_instance.ec2_instances[0].id
    }
  }
  </code></pre>
  <p>Any suggestion is welcome. I tried to create an easy Terraform code to illustrate what I'm trying to do. And to me it should be straight forward.
  I create the role. I create the instance profile. I create the association passing the proper role and the instance id.</p>