ssm-cloudwatch-instance-role.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: "IAM Role and Instance Profile for CloudWatch and SSM"
Resources:
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "SSMCloudWatchInstanceRole"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: "SSMCloudWatchInstanceRole"
      Path: "/"
      Roles:
        - !Ref InstanceRole