<p>If you need to run more than one command, this is what I found works best for me is to pass this as the command array where each line is an item in the array:</p>
<pre><code>#!/bin/bash
sudo -Hiu username bash &lt;&lt; END
command1 arg1 arg2
command2 arg3 arg4
command3 arg5 arg6
END
</code></pre>
<p>Whole command will look something like this:</p>
<pre><code>aws ssm send-command --instance-ids i-xxxx --document-name AWS-RunShellScript --parameters commands='[&quot;#!/bin/bash&quot;,&quot;sudo -Hiu username bash &lt;&lt; EOF&quot;,&quot;command1 arg1 arg2&quot;,&quot;command2 arg3 arg4&quot;,&quot;command3 arg5 arg6&quot;,&quot;END&quot;]'
</code></pre>

CC BY-SA 4.0
2024-09-13T07:35:30.397Z
your solution saved a hell lot of my rest of the day, I was actually struggling to invoke a remote command on VM running on EC2 from scheduled python lambda function via boto3's ssm.send_command. Your way of sending this commands saved my day :) Many thanks again! +1 to your answer
Dhwanit
CC BY-SA 4.0
2024-07-25T15:22:01.553Z
2024-07-25T15:22:01.553Z
Zach Baker
<p>I didn't find anything on AWS or boto3 docs that allows for that, but I was able to execute as a different user using the <code>runuser</code> command. In theory, you could do the same thing with a combination of <code>sudo</code> and <code>su</code> commands, but this one is pretty simpler.</p>
<p>For that, you can do as follows:</p>
<pre><code>runuser -l  userNameHere -c '/path/to/command arg1 arg2'
</code></pre>
<p>Since send-command executes as root, you don't have any issues.</p>
<p><strong>Note:</strong> I thought that send-command uses in some way a session managed by the <em>SSM Session Manager</em>, but I was wrong. I spent a good time configuring <em>SSM Session Manager</em> preferences and tagging IAM resources according to <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-run-as.html" rel="noreferrer">this doc</a> and <a href="https://reinvent2019.aws-management.tools/mgt406/en/optional/step5.html" rel="noreferrer">this one</a>, but send-command always execute as root as far I saw.</p>
<p>Sources:</p>
<ul>
<li><a href="https://man7.org/linux/man-pages/man1/runuser.1.html" rel="noreferrer">https://man7.org/linux/man-pages/man1/runuser.1.html</a></li>
<li><a href="https://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/" rel="noreferrer">https://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/</a></li>
</ul>

CC BY-SA 4.0
2022-02-09T19:03:33.567Z
Thank you! This also helped me when trying to execute a script via _AWS Systems Manager - Run Command_, since `su - username` wasn't allowing me to switch the user from `root`.
Leo Folsom
CC BY-SA 4.0
2023-12-07T17:15:06.663Z
Thank you so much for this, you saved my day. Documentation is so weak. And running command after or with `sudo su - username` did not work at all, even if I send it in same command separated with `;` or as list of command.
MohitC
CC BY-SA 4.0
2020-07-22T20:41:25.573Z
2020-07-22T20:50:44.047Z
2020-07-22T20:50:44.047Z
M. Gleria
<h2>Background</h2>

<p>I want to automatically configure an EC2 via a build, using the aws cli and ssm.</p>

<p>The (manual) setup for the container looks something like this:</p>

<ul>
<li>Create an EC2</li>
<li>Run a shell script as root</li>
<li>Run a shell script as a specific user</li>
</ul>

<h2>Question</h2>

<p>Is it possible to run a command on an ec2 utilising a tool such as <code>aws ssm send-command</code> specifying the linux user which will execute the command?</p>

<p>Assuming the command is a shell script, would specifying the user inside the script do the same job? e.g using <code>sudo su my_user</code></p>

CC BY-SA 4.0
2020-07-24T15:38:04.257Z
Welcome to DevOps.SE.  Running `sudo` when you're already `root` is superfluous.  Just `su` and then do stuff as that user.  https://stackoverflow.com/a/3420291/2002471
chicks
<amazon-web-services><linux><aws-cli>
Running a command as a specific user on an ec2 using ssm
Max Colledge
# Running a command as a specific user on an ec2 using ssm

(Asked by: username_0 on 2020-01-06)

## Background

I want to automatically configure an EC2 via a build, using the aws cli and ssm.

The (manual) setup for the container looks something like this:

* Create an EC2
* Run a shell script as root
* Run a shell script as a specific user

## Question

Is it possible to run a command on an ec2 utilising a tool such as `aws ssm send-command` specifying the linux user which will execute the command?

Assuming the command is a shell script, would specifying the user inside the script do the same job? e.g using `sudo su my_user`

**Tags:** amazon-web-services, linux, aws-cli

> **Comments:**
> **username_1**: Welcome to DevOps.SE.  Running `sudo` when you're already `root` is superfluous.  Just `su` and then do stuff as that user.  https://stackoverflow.com/a/3420291/2002471  

---

## 2 answers

### Answer by username_4 on 2020-07-22. Score: 10 | Accepted answer

I didn't find anything on AWS or boto3 docs that allows for that, but I was able to execute as a different user using the runuser command. In theory, you could do the same thing with a combination of sudo and su commands, but this one is pretty simpler.
For that, you can do as follows:
runuser -l  userNameHere -c '/path/to/command arg1 arg2'

Since send-command executes as root, you don't have any issues.
Note: I thought that send-command uses in some way a session managed by the SSM Session Manager, but I was wrong. I spent a good time configuring SSM Session Manager preferences and tagging IAM resources according to this doc and this one, but send-command always execute as root as far I saw.
Sources:

https://man7.org/linux/man-pages/man1/runuser.1.html
https://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/

> **Comments:**
> **username_5**: Thank you! This also helped me when trying to execute a script via _AWS Systems Manager - Run Command_, since `su - username` wasn't allowing me to switch the user from `root`.  
> **username_6**: Thank you so much for this, you saved my day. Documentation is so weak. And running command after or with `sudo su - username` did not work at all, even if I send it in same command separated with `;` or as list of command.  

---

### Answer by username_2 on 2024-07-25. Score: 1

If you need to run more than one command, this is what I found works best for me is to pass this as the command array where each line is an item in the array:
#!/bin/bash
sudo -Hiu username bash << END
command1 arg1 arg2
command2 arg3 arg4
command3 arg5 arg6
END

Whole command will look something like this:
aws ssm send-command --instance-ids i-xxxx --document-name AWS-RunShellScript --parameters commands='["#!/bin/bash","sudo -Hiu username bash << EOF","command1 arg1 arg2","command2 arg3 arg4","command3 arg5 arg6","END"]'

> **Comments:**
> **username_3**: your solution saved a hell lot of my rest of the day, I was actually struggling to invoke a remote command on VM running on EC2 from scheduled python lambda function via boto3's ssm.send_command. Your way of sending this commands saved my day :) Many thanks again! +1 to your answer  

---

