Answers: <p>If you need to run more than one command, this is what I found works best for me is to pass this as the command array where each line is an item in the array:</p>
  <pre><code>#!/bin/bash
  sudo -Hiu username bash &lt;&lt; END
  command1 arg1 arg2
  command2 arg3 arg4
  command3 arg5 arg6
  END
  </code></pre>
  <p>Whole command will look something like this:</p>
  <pre><code>aws ssm send-command --instance-ids i-xxxx --document-name AWS-RunShellScript --parameters commands='[&quot;#!/bin/bash&quot;,&quot;sudo -Hiu username bash &lt;&lt; EOF&quot;,&quot;command1 arg1 arg2&quot;,&quot;command2 arg3 arg4&quot;,&quot;command3 arg5 arg6&quot;,&quot;END&quot;]'
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-09-13T07:35:30.397Z
Answers: your solution saved a hell lot of my rest of the day, I was actually struggling to invoke a remote command on VM running on EC2 from scheduled python lambda function via boto3's ssm.send_command. Your way of sending this commands saved my day :) Many thanks again! +1 to your answer
Answers: Dhwanit
Answers: CC BY-SA 4.0
Answers: 2024-07-25T15:22:01.553Z
Answers: 2024-07-25T15:22:01.553Z
Answers: Zach Baker
Answers: <p>I didn't find anything on AWS or boto3 docs that allows for that, but I was able to execute as a different user using the <code>runuser</code> command. In theory, you could do the same thing with a combination of <code>sudo</code> and <code>su</code> commands, but this one is pretty simpler.</p>
  <p>For that, you can do as follows:</p>
  <pre><code>runuser -l  userNameHere -c '/path/to/command arg1 arg2'
  </code></pre>
  <p>Since send-command executes as root, you don't have any issues.</p>
  <p><strong>Note:</strong> I thought that send-command uses in some way a session managed by the <em>SSM Session Manager</em>, but I was wrong. I spent a good time configuring <em>SSM Session Manager</em> preferences and tagging IAM resources according to <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-run-as.html" rel="noreferrer">this doc</a> and <a href="https://reinvent2019.aws-management.tools/mgt406/en/optional/step5.html" rel="noreferrer">this one</a>, but send-command always execute as root as far I saw.</p>
  <p>Sources:</p>
  <ul>
  <li><a href="https://man7.org/linux/man-pages/man1/runuser.1.html" rel="noreferrer">https://man7.org/linux/man-pages/man1/runuser.1.html</a></li>
  <li><a href="https://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/" rel="noreferrer">https://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/</a></li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2022-02-09T19:03:33.567Z
Answers: Thank you! This also helped me when trying to execute a script via _AWS Systems Manager - Run Command_, since `su - username` wasn't allowing me to switch the user from `root`.
Answers: Leo Folsom
Answers: CC BY-SA 4.0
Answers: 2023-12-07T17:15:06.663Z
Answers: Thank you so much for this, you saved my day. Documentation is so weak. And running command after or with `sudo su - username` did not work at all, even if I send it in same command separated with `;` or as list of command.
Answers: MohitC
Answers: CC BY-SA 4.0
Answers: 2020-07-22T20:41:25.573Z
Answers: 2020-07-22T20:50:44.047Z
Answers: 2020-07-22T20:50:44.047Z
Answers: M. Gleria
Body: <h2>Background</h2>
  
  <p>I want to automatically configure an EC2 via a build, using the aws cli and ssm.</p>
  
  <p>The (manual) setup for the container looks something like this:</p>
  
  <ul>
  <li>Create an EC2</li>
  <li>Run a shell script as root</li>
  <li>Run a shell script as a specific user</li>
  </ul>
  
  <h2>Question</h2>
  
  <p>Is it possible to run a command on an ec2 utilising a tool such as <code>aws ssm send-command</code> specifying the linux user which will execute the command?</p>
  
  <p>Assuming the command is a shell script, would specifying the user inside the script do the same job? e.g using <code>sudo su my_user</code></p>
  
Comments: CC BY-SA 4.0
Comments: 2020-07-24T15:38:04.257Z
Comments: Welcome to DevOps.SE.  Running `sudo` when you're already `root` is superfluous.  Just `su` and then do stuff as that user.  https://stackoverflow.com/a/3420291/2002471
Comments: chicks
Tags: <amazon-web-services><linux><aws-cli>
Title: Running a command as a specific user on an ec2 using ssm
UserDisplayName: Max Colledge
ThreadText: # Running a command as a specific user on an ec2 using ssm
  
  (Asked by: username_0 on 2020-01-06)
  
  ## Background
  
  I want to automatically configure an EC2 via a build, using the aws cli and ssm.
  
  The (manual) setup for the container looks something like this:
  
  * Create an EC2
  * Run a shell script as root
  * Run a shell script as a specific user
  
  ## Question
  
  Is it possible to run a command on an ec2 utilising a tool such as `aws ssm send-command` specifying the linux user which will execute the command?
  
  Assuming the command is a shell script, would specifying the user inside the script do the same job? e.g using `sudo su my_user`
  
  **Tags:** amazon-web-services, linux, aws-cli
  
  > **Comments:**
  > **username_1**: Welcome to DevOps.SE.  Running `sudo` when you're already `root` is superfluous.  Just `su` and then do stuff as that user.  https://stackoverflow.com/a/3420291/2002471  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_4 on 2020-07-22. Score: 10 | Accepted answer
  
  I didn't find anything on AWS or boto3 docs that allows for that, but I was able to execute as a different user using the `runuser` command. In theory, you could do the same thing with a combination of `sudo` and `su` commands, but this one is pretty simpler.
  
  For that, you can do as follows:
  
  ```
  runuser -l  userNameHere -c '/path/to/command arg1 arg2'
  
  ```
  
  Since send-command executes as root, you don't have any issues.
  
  **Note:** I thought that send-command uses in some way a session managed by the *SSM Session Manager*, but I was wrong. I spent a good time configuring *SSM Session Manager* preferences and tagging IAM resources according to [this doc](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-run-as.html) and [this one](https://reinvent2019.aws-management.tools/mgt406/en/optional/step5.html), but send-command always execute as root as far I saw.
  
  Sources:
  
  * <https://man7.org/linux/man-pages/man1/runuser.1.html>
  * <https://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/>
  
  > **Comments:**
  > **username_5**: Thank you! This also helped me when trying to execute a script via _AWS Systems Manager - Run Command_, since `su - username` wasn't allowing me to switch the user from `root`.  
  > **username_6**: Thank you so much for this, you saved my day. Documentation is so weak. And running command after or with `sudo su - username` did not work at all, even if I send it in same command separated with `;` or as list of command.  
  
  ---
  
  ### Answer by username_2 on 2024-07-25. Score: 1
  
  If you need to run more than one command, this is what I found works best for me is to pass this as the command array where each line is an item in the array:
  
  ```
  #!/bin/bash
  sudo -Hiu username bash << END
  command1 arg1 arg2
  command2 arg3 arg4
  command3 arg5 arg6
  END
  
  ```
  
  Whole command will look something like this:
  
  ```
  aws ssm send-command --instance-ids i-xxxx --document-name AWS-RunShellScript --parameters commands='["#!/bin/bash","sudo -Hiu username bash << EOF","command1 arg1 arg2","command2 arg3 arg4","command3 arg5 arg6","END"]'
  
  ```
  
  > **Comments:**
  > **username_3**: your solution saved a hell lot of my rest of the day, I was actually struggling to invoke a remote command on VM running on EC2 from scheduled python lambda function via boto3's ssm.send_command. Your way of sending this commands saved my day :) Many thanks again! +1 to your answer  
  
  ---
  
  