Need IAM permissions for Session Manager added to Boskos-managed AWS accounts

[randomvariable]

Porting over from kubernetes/test-infra#17190 by @detiber

What would you like to be added:

Recently we removed creation of a Bastion host by default from cluster-api-provider-aws and would prefer to avoid creating one for the purposes of testing and would rather use ssh proxied over AWS Session Manager to connect to remote instances for retrieving logs during testing instead.

Will need one of the below done against each AWS subaccount users that is registered as an aws-account resource in Boskos:

Attach the AmazonSSMFullAccess policy
Create a policy with the permissions outlined in docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-restrict-access.html and attach it, or add it as an inline policy

[detiber]

/assign @justinsb

[randomvariable]

Is there anything we can do to get this moving? We kind of missed an upgrade bug for Kubernetes 1.19 for a few reasons, but would have been compounded by not having the logs that SSM would have provided.

[justinsb]

I added the permission to #1016 (and it's in the latest accounts that I just created, but we should wait till #1016 merges before applying to boskos)

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[detiber]

/lifecycle frozen

[spiffxp]

/priority backlog
I have lost track of where we're at with AWS account management