diff --git a/cloudformation-templates/aws_connector_installer/aws-connector-v2-installer.yaml b/cloudformation-templates/aws_connector_installer/aws-connector-v2-installer.yaml
index 6c87f7a..d1d9c68 100644
--- a/cloudformation-templates/aws_connector_installer/aws-connector-v2-installer.yaml
+++ b/cloudformation-templates/aws_connector_installer/aws-connector-v2-installer.yaml
@@ -128,7 +128,7 @@ Resources:
               - Effect: Allow
                 Action: 'ec2-instance-connect:OpenTunnel'
                 Resource: !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance-connect-endpoint/*'
-        # Allow starting and terminating ssm sessions to any instance (for ssm)
+        # Allow starting and terminating ssm sessions + sending commands to any instance (for ssm)
         - PolicyName: StartAndTerminateSsmSessions
           PolicyDocument:
             Version: '2012-10-17'
@@ -140,6 +140,15 @@ Resources:
                   - !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance/*'
                   - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-StartSSHSession' # legacy
                   - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/SSM-SessionManagerRunShell'
+              - Effect: Allow
+                Action:
+                  - 'ssm:SendCommand'
+                  - 'ssm:GetCommandInvocation'
+                Resource:
+                  - !Sub 'arn:aws:ecs:*:${AWS::AccountId}:task/*'
+                  - !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance/*'
+                  - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-RunShellScript'
+                  - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-RunPowerShellScript' # for windows targets
               - Effect: Allow
                 Action: 'ssm:TerminateSession'
                 Resource:
diff --git a/cloudformation-templates/aws_connector_installer_insecure/aws-connector-v2-installer-insecure.yaml b/cloudformation-templates/aws_connector_installer_insecure/aws-connector-v2-installer-insecure.yaml
index 490028c..743a565 100644
--- a/cloudformation-templates/aws_connector_installer_insecure/aws-connector-v2-installer-insecure.yaml
+++ b/cloudformation-templates/aws_connector_installer_insecure/aws-connector-v2-installer-insecure.yaml
@@ -102,7 +102,7 @@ Resources:
               - Effect: Allow
                 Action: 'ec2-instance-connect:OpenTunnel'
                 Resource: !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance-connect-endpoint/*'
-        # Allow starting and terminating ssm sessions to any instance (for ssm)
+        # Allow starting and terminating ssm sessions + sending commands to any instance (for ssm)
         - PolicyName: StartAndTerminateSsmSessions
           PolicyDocument:
             Version: '2012-10-17'
@@ -114,6 +114,15 @@ Resources:
                   - !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance/*'
                   - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-StartSSHSession' # legacy
                   - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/SSM-SessionManagerRunShell'
+              - Effect: Allow
+                Action:
+                  - 'ssm:SendCommand'
+                  - 'ssm:GetCommandInvocation'
+                Resource:
+                  - !Sub 'arn:aws:ecs:*:${AWS::AccountId}:task/*'
+                  - !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance/*'
+                  - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-RunShellScript'
+                  - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-RunPowerShellScript' # for windows targets
               - Effect: Allow
                 Action: 'ssm:TerminateSession'
                 Resource:
diff --git a/cloudformation-templates/aws_connector_installer_invite/aws-connector-v2-installer-invite.yaml b/cloudformation-templates/aws_connector_installer_invite/aws-connector-v2-installer-invite.yaml
index 777a7f1..b73d25e 100644
--- a/cloudformation-templates/aws_connector_installer_invite/aws-connector-v2-installer-invite.yaml
+++ b/cloudformation-templates/aws_connector_installer_invite/aws-connector-v2-installer-invite.yaml
@@ -113,7 +113,7 @@ Resources:
               - Effect: Allow
                 Action: 'ec2-instance-connect:OpenTunnel'
                 Resource: !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance-connect-endpoint/*'
-        # Allow starting and terminating ssm sessions to any instance (for ssm)
+        # Allow starting and terminating ssm sessions + sending commands to any instance (for ssm)
         - PolicyName: StartAndTerminateSsmSessions
           PolicyDocument:
             Version: '2012-10-17'
@@ -125,6 +125,15 @@ Resources:
                   - !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance/*'
                   - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-StartSSHSession' # legacy
                   - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/SSM-SessionManagerRunShell'
+              - Effect: Allow
+                Action:
+                  - 'ssm:SendCommand'
+                  - 'ssm:GetCommandInvocation'
+                Resource:
+                  - !Sub 'arn:aws:ecs:*:${AWS::AccountId}:task/*'
+                  - !Sub 'arn:aws:ec2:*:${AWS::AccountId}:instance/*'
+                  - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-RunShellScript'
+                  - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:document/AWS-RunPowerShellScript' # for windows targets
               - Effect: Allow
                 Action: 'ssm:TerminateSession'
                 Resource: