EC2实例不会自动加入AWS管理的广告域

Question

我正在设置AWS托管Active Directory，并希望设置一个EC2实例（Windows Server 2019 R2），用于远程管理广告，并且具有用户登录的AWS Workspace客户端。但是不幸的是，尽管有适当的许可，EC2实例确实可以不自动加入域。

根据AWS文章： https://docs.aws。 Amazon.com/directoryservice/latest/admin-guide/launching_instance.html

这是分配的角色： AmazonssmmanagedInstancecore

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "ssm:DescribeAssociation",
            "ssm:GetDeployablePatchSnapshotForInstance",
            "ssm:GetDocument",
            "ssm:DescribeDocument",
            "ssm:GetManifest",
            "ssm:GetParameter",
            "ssm:GetParameters",
            "ssm:ListAssociations",
            "ssm:ListInstanceAssociations",
            "ssm:PutInventory",
            "ssm:PutComplianceItems",
            "ssm:PutConfigurePackageResult",
            "ssm:UpdateAssociationStatus",
            "ssm:UpdateInstanceAssociationStatus",
            "ssm:UpdateInstanceInformation"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "ssmmessages:CreateControlChannel",
            "ssmmessages:CreateDataChannel",
            "ssmmessages:OpenControlChannel",
            "ssmmessages:OpenDataChannel"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "ec2messages:AcknowledgeMessage",
            "ec2messages:DeleteMessage",
            "ec2messages:FailMessage",
            "ec2messages:GetEndpoint",
            "ec2messages:GetMessages",
            "ec2messages:SendReply"
        ],
        "Resource": "*"
    }
]

}

和另一个政策为： AmazonssmDirectoryServiceAccess

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "ds:CreateComputer",
            "ds:DescribeDirectories"
        ],
        "Resource": "*"
    }
]

}，

具有两个政策，我启动了一个具有AMI ID的实例： AMI-041306C411C38A789

成功发布后， set命令查看域加入，但不幸的是，我必须手动执行相同的操作。有人可以建议为什么这样吗？ 您可以在此处查看命令页面

只是确保域和实例在同一域中VPC。我可以使用实例识别的域的DNS地址进行检查。