instance-ssm-parameters-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:DeleteParameter",
        "ssm:GetParameters",
        "ssm:GetParameter"
      ],
      "Resource": "${arn_ssm_parameters_path_tokens}*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath"
      ],
      "Resource": [
        "${arn_ssm_parameters_path_config}",
        "${arn_ssm_parameters_path_config}/*"
      ]
    }
  ]
}