Step 2: Create a Systems Manager Cloud Connector

To create a Systems Manager Cloud Connector

1. Run the following command. Replace the placeholder values with your Workload Identity Pool provider, connector service account email, target project IDs, the Systems Manager GCP federation role ARN, and the Amazon Config connector ARN from Step 1.

   Create the federation role before you run this command

   Before you run this command, the Systems Manager GCP federation role that --role-arn identifies must already exist. Its trust policy must also allow the Systems Manager service principal (ssm.amazonaws.com) to assume it. The Amazon CLI and API do not create this role for you. If either requirement is not met, the command fails. The error message is ValidationException: Nonexistent role or missing ssm service principal in trust policy. Create the role first with the trust and permissions policies in GCP federation role. Use the same role ARN that you used as the OIDC provider attribute-condition subject in GCP prerequisites.

   aws ssm create-cloud-connector \
       --display-name "MyGcpConnector" \
       --configuration '{
           "GcpConfiguration": {
               "WorkloadIdentityPoolProvider": "projects/HOST_PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID",
               "ServiceAccountEmail": "SERVICE_ACCOUNT_ID@HOST_PROJECT_ID.iam.gserviceaccount.com",
               "Targets": {
                   "Projects": [
                       {"ProjectId": "PROJECT_ID"}
                   ]
               }
           }
       }' \
       --role-arn "arn:aws:iam::ACCOUNT_ID:role/service-role/SSM-GCPRole-CONNECTOR_NAME" \
       --config-connector-arn CONFIG_CONNECTOR_ARN

   If you don't record with Amazon Config, leave out --config-connector-arn.

   To target multiple projects, add more entries to Projects (up to 75). To target an entire GCP organization, replace the Targets value with "OrganizationId": "ORGANIZATION_ID". If you record with Amazon Config, the Amazon Config connector from Step 1 must have the same gcpOrganizationId.

   The response returns the CloudConnectorId. Note this value for future operations.

2. Verify the Cloud Connector was created successfully:

   aws ssm get-cloud-connector \
       --cloud-connector-id CLOUD_CONNECTOR_ID