search

aws / amazon-ssm-agent

An agent to enable remote management of your EC2 instances, on-premises servers, or virtual machines (VMs).
https://aws.amazon.com/systems-manager/
Apache License 2.0
1.06k stars 322 forks source link

An error occurred (BadRequest) when calling the StartSession operation: #325

Closed altjx closed 3 years ago

altjx commented 3 years ago

After following the steps here: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-managedinstances.html

I am trying to finally connect to a target instance that I can see, but I'm unable to due to the following error:

An error occurred (BadRequest) when calling the StartSession operation:

I am running the following command:

aws ssm start-session --target mi-[instance-id] --profile my-profile --region us-east-2

According to https://github.com/aws/amazon-ssm-agent/issues/162, someone mentioned that it's probably just the fact that the target system doesn't have the certificates installed, but I have confirmed them as shown below:

awk -v cmd='openssl x509 -noout -subject' '
    /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt \
| grep -i amazon
subject=C = US, O = Amazon, CN = Amazon Root CA 1
subject=C = US, O = Amazon, CN = Amazon Root CA 2
subject=C = US, O = Amazon, CN = Amazon Root CA 3
subject=C = US, O = Amazon, CN = Amazon Root

This error doesn't really provide me with any valuable information to research, so I'm not quite sure if I'm just simply missing a step in the process or if it's because of something else.

How can I tell if it's related to an IAM role issue, certificate, etc.?

Any help would be greatly appreciated.

altjx commented 3 years ago

Just found out through the AWS UI that you can't start sessions while using a standard tier, and have to upgrade to the advanced tier, which costs to do this.