AWS Session Manager: Connect to EC2 Without SSH

Stop opening port 22 and passing around key files. How Session Manager works, what an instance needs (agent, IAM role, network path), port forwarding, logging and locking it down with IAM.

The traditional way to reach a Linux server is SSH: open port 22 in a security group, distribute key files, maybe run a bastion host. Each piece is something to secure and audit. AWS Systems Manager Session Manager replaces all of it: you open a shell from the console or CLI, with no inbound ports, no keys and full logging.

How it works

The SSM Agent on the instance (preinstalled on Amazon Linux, Ubuntu Server AMIs and Windows Server AMIs from AWS) makes an outbound HTTPS connection to the Systems Manager service.
When you start a session, Systems Manager checks your IAM permissions and relays the session over that existing outbound channel.
Nothing ever connects inbound to the instance, so the security group can have no inbound rules at all.

What an instance needs

The agent running and reasonably current.
An IAM instance profile with the managed policy AmazonSSMManagedInstanceCore (or Default Host Management Configuration enabled for the account, which grants it without a per-instance role).
A network path to the Systems Manager endpoints: through a NAT gateway or internet gateway, or, for fully private subnets, interface VPC endpoints for ssm, ssmmessages and ec2messages.

When all three are in place, the instance appears under Fleet Manager as a managed node, and the Connect → Session Manager button works.

Starting a session

From the console: select the instance, choose Connect, then the Session Manager tab. From the CLI (with the Session Manager plugin installed):

aws ssm start-session --target i-0123456789abcdef0

Port forwarding: reach private services safely

Session Manager can forward ports, which replaces many bastion use cases:

# Forward local 8080 to port 80 on the instance
aws ssm start-session --target i-0123 \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["80"],"localPortNumber":["8080"]}'

# Reach a private RDS database through the instance
aws ssm start-session --target i-0123 \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"host":["mydb.abc.eu-west-1.rds.amazonaws.com"],"portNumber":["5432"],"localPortNumber":["5432"]}'

You can even tunnel SSH itself through Session Manager when a tool insists on SSH, without opening port 22.

Control who can connect

Access is pure IAM. Allow ssm:StartSession on specific instances or on instances with a tag:

{
  "Effect": "Allow",
  "Action": "ssm:StartSession",
  "Resource": "arn:aws:ec2:*:*:instance/*",
  "Condition": {"StringEquals": {"ssm:resourceTag/Team": "payments"}}
}

Add permission for ssm:TerminateSession on the user's own sessions so they can end them. Session preferences let you set the run-as user, idle timeout and shell profile.

Logging and auditing

CloudTrail records who started which session and when.
Session preferences can stream full session transcripts to CloudWatch Logs or S3, encrypted with KMS.

Compared with SSH, where commands typed are rarely logged centrally, this is a big step for audits and incident investigations.

Troubleshooting "instance not showing in Session Manager"

Is the instance profile attached with AmazonSSMManagedInstanceCore? After attaching, the agent can take a few minutes to register (restarting the agent speeds it up).
Does the instance have outbound HTTPS to the SSM endpoints (NAT, internet gateway or the three interface endpoints)? Check route tables, security group outbound rules and NACLs.
Is the agent installed and running? Old custom AMIs may lack it.
Is the instance's clock correct and its DNS resolution working?

The rest of Systems Manager

Session Manager is one part of a larger toolbox: Run Command executes commands across fleets, Patch Manager automates OS patching, Parameter Store stores configuration and secrets, State Manager enforces configuration and Automation runs runbooks, for example triggered by a CloudWatch alarm.

Practice it

Use Systems Manager in Automating EC2 Stop Using EventBridge and Systems Manager, Fleet Operations: Run Command, State Manager and Inventory, Patch Manager and Systems Manager Automation: Write a Runbook.

FAQ

Does Session Manager cost anything?

No extra charge for sessions to EC2 instances. You pay for related resources such as VPC endpoints, NAT data and log storage.

Does it work on Windows?

Yes, with a PowerShell session, and port forwarding can carry RDP.

AWS Systems Manager Session Manager: Connect to EC2 Without SSH Keys or Open Ports