Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

title: “AWS Systems Manager Session Manager” created: 2026-07-20 updated: 2026-07-20 type: knowledge tags:

  • aws
  • ssm
  • ec2
  • devops
  • security
  • certification

AWS Systems Manager Session Manager

What It Is

Session Manager is a capability of AWS Systems Manager that lets you open a secure shell session to an EC2 instance without opening inbound ports (SSH/22), managing bastion hosts, or distributing SSH keys.

Why It Matters

Session Manager is the AWS-recommended way to access EC2 instances interactively. It eliminates common attack vectors (exposed SSH ports) and provides full audit logging. Frequently tested as the secure alternative to SSH.

Key Concepts

How It Works

User (Console/CLI) → HTTPS (443) → SSM Agent on EC2 → Shell session
  1. The EC2 instance runs the SSM Agent (pre-installed on Amazon Linux 2, Ubuntu, Windows AMIs)
  2. The agent communicates outbound to the SSM service over HTTPS (port 443)
  3. No inbound security group rules needed — no port 22 exposure
  4. User initiates session from Console or CLI: aws ssm start-session --target i-xxxxx

Prerequisites

RequirementDetail
SSM AgentMust be installed and running on the instance
IAM RoleInstance needs a role with AmazonSSMManagedInstanceCore policy
NetworkOutbound HTTPS (443) to SSM endpoints (or VPC endpoint)
No SSH key neededAuthentication is handled via IAM

Security Benefits

  • No open inbound ports — security groups can deny all inbound traffic
  • No SSH keys to manage — access controlled via IAM policies
  • Full audit trail — sessions logged to CloudTrail, optionally to S3/CloudWatch
  • Session recording — can capture all commands and output
  • IAM-based access control — fine-grained who-can-connect-to-what

Connecting via Console

  1. EC2 → Instances → select instance → Connect
  2. Choose Session Manager tab
  3. Click Connect → browser-based shell opens

Gotchas

  • Instance must have outbound internet or a VPC endpoint for ssm, ssmmessages, and ec2messages
  • If the SSM Agent is stopped or the IAM role is missing, the instance won’t appear as “managed”
  • Session Manager works with private instances (no public IP needed)
  • Default shell is sh; configure in SSM preferences for bash

See Also

  • [[iam-instance-profiles]]
  • [[aws-cli-s3-commands]]