Beware SSM default permissions are not least privilege! @awscloud should really fix this to be secure by default...