In my case there was VPC endpoint already created by another team member for SSM which I was not aware of. I simply added an inbound rule in Security Group attached to that VPC endpoint to allow 443 from Security group attached to EC2 instance.