Error "Couldn't Assume/Create SSM SLR" when executing a recommendations

Overview

This article outlines the steps to resolve the error "Couldn't assume/create SSM SLR" that some users may encounter when CloudFix fails to execute a recommendation. The error is typically due to a lack of proper permissions in the IAM role attempting to execute the change.

Information

When attempting to implement cost-saving recommendations in CloudFix, you may encounter the following error message:

Failed to schedule runbook after step approved. Invalid permissions: Couldn't assume/create SSM SLR, check permissions for the calling identity.

This error usually means the AWS account that owns the resource being fixed (the "resource account") does not yet have the AWSServiceRoleForAmazonSSM service-linked role, and the role CloudFix uses to run the fixer was denied permission to create it on the fly. CloudFix executes fixers as SSM Automation executions that target the resource account and its region directly, so this service-linked role needs to exist in that resource account — not in your CloudFix management account.

To fix this issue:

Quick fix — create the service-linked role manually:

1. Open the resource account (the AWS account that owns the resource the recommendation applies to) via AWS CloudShell or the AWS CLI.
2. Run the following command: aws iam create-service-linked-role --aws-service-name ssm.amazonaws.com --region <your_region>

This only needs to be done once per account. Once the service-linked role exists, CloudFix no longer needs to create it, so the missing-permission error will not recur even if the permission below is never added.

If you'd rather fix the underlying permission:

1. Current CloudFix onboarding stacks already grant iam:CreateServiceLinkedRole (scoped to the SSM service-linked role) to the cloudfix-ssm-update-role in each resource account, so this error is usually a sign the resource account is on an outdated stack. In the CloudFix portal, go to Settings > Finders & Fixers and check the Template Version shown for the account. If it is behind, click Upgrade to latest and follow the instructions to update the stack.
2. If the stack is already current, check whether an AWS Organizations service control policy (SCP) or a permission boundary attached to cloudfix-ssm-update-role in that resource account is denying iam:CreateServiceLinkedRole, and adjust it to allow this action for the ssm.amazonaws.com service.

After making the above changes, please give it some time for CloudFix to re-evaluate this opportunity as still valid and make it available to you again in the portal for another execution.