AWS Config Rule Automatic Remediation Failed (SSM Automation shows Success)

Hello, i try to use AWS Config Rule with Auto Remediation, the rule should detect security groups with open SSH and remove the ingress. I Use "INCOMING_SSH_DISABLED" (restricted-ssh) managed rule and AWS-DisablePublicAccessForSecurityGroup SSM document, the remediation is configured with terraform:

  target_id = "AWS-DisablePublicAccessForSecurityGroup"
  target_type = "SSM_DOCUMENT"
  resource_type = "AWS::EC2::SecurityGroup"
  target_version = "1"

  parameter {
    name = "AutomationAssumeRole"
    static_value = aws_iam_role.ssh-remediation-role.arn
  }

  parameter {
    name = "GroupId"
    resource_value = "RESOURCE_ID"
  

The role is:

data "aws_iam_policy_document" "ssm-automation-assume-role" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      identifiers = ["ssm.amazonaws.com"]
      type = "Service"
    }
    condition {
      test = "StringEquals"
      variable = "aws:SourceAccount"
      values = [local.account-id]
    }
    condition {
      test = "ArnLike"
      variable = "aws:SourceArn"
      values = ["arn:aws:ssm:*:${local.account-id}:automation-execution/*"]
    }
  }
}

resource "aws_iam_role" "ssh-remediation-role" {
  assume_role_policy = data.aws_iam_policy_document.ssm-automation-assume-role.json
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
  ]

When i create such security group AWS Config detects it, runs remediation, the Automation finishes with result 'Success' (and the security group is properly updated, so the remediation works) but AWS Config shows "Failed", when i try to see some details with aws configservice describe-remediation-execution-status i get:

            "State": "FAILED",
            "StepDetails": [
                {
                    "Name": "GetAutomationExecution",
                    "State": "FAILED",
                    "ErrorMessage": "AccessDeniedException while calling STS for execution: SsmExecutionId(value=d69b27e5-da83-43de-b563-9d9040c2cf03)"
                }
            ],

I tried to google this error but i have not found anything. How can i solve this issue?

Thank you for your help.