The instance web-mg1lm2 is running and cannot be reached by Session Manager yet. See the failure, then fix it. The trust document is in ~/ec2-trust.json.

ID=$(aws ec2 describe-instances --filters Name=tag:Name,Values=web-mg1lm2 --query "Reservations[0].Instances[0].InstanceId" --output text)
aws ssm start-session --target $ID

Create the role ssm-role-mg1lm2 with AmazonSSMManagedInstanceCore, the instance profile ssm-profile-mg1lm2, associate it, and check describe-instance-information until the instance is Online. Then:

aws ssm start-session --target $ID
whoami
cat /etc/os-release
aws sts get-caller-identity
exit