Ona Environment Fails: AWS account policy blocks ssm:SendCommand
Quick answer
The runner needs ssm:SendCommand and ssm:GetCommandInvocation. Update the runner stack and have your AWS admin check for an SCP deny, which an IAM allow cannot override.
Most likely fix: Update permissions
How to fix it
Try these in order — the most common fix is first.
1. Update permissions
- Update the runner CloudFormation stack to apply the current IAM policy
- Ask your AWS administrator to check SCPs
- Use Resource * for ssm:GetCommandInvocation; ssm:SendCommand can stay scoped to environment instances and the AWS-RunShellScript document
Did this fix it?
Symptoms
Environments fail with AWS account policy blocks ssm:SendCommand, the runner is marked degraded, or startup is slow.
Why it happens
- Service Control Policy denies SSM actions
- Runner IAM policy is outdated
This guide also covers
- ssm:sendcommand gitpod
- ona runner degraded
- ona environment fails to start
Still not working?
If Gitpod keeps failing, you're not alone. See every Gitpod problem users report or the alternatives people switch to.
Have an app idea? Our small team builds any software: web and mobile apps, games, desktop, AI tools. Price agreed together.
Talk to usThe same problem in other apps
Other Gitpod errors
- Gitpod Classic Shutdown: How to Migrate to Ona Before October 15
- Gitpod / Ona Environment Disappeared or Deleted: Archive and Auto-Delete Explained
- Ona (Gitpod) Credits Running Out: How OCUs Are Used
- Gitpod Classic Billing: Usage Limit Reached, Credits and Invoices
- Ona AWS Runner Failed: ROLLBACK_COMPLETE and ECS Circuit Breaker Errors
- Ona Environment Starts Then Stops in Seconds (Custom CA Bundle)
- Ona GCP Runner Not Connected: Terraform, Health Check and Zone Resource Errors
- Gitpod Classic JetBrains Gateway Not Working or Workspace Won't Start