AWS SSM Session Manager

AWS SSM Session Manager is a feature of AWS Systems Manager (SSM). It gives engineers interactive shell access and port forwarding to EC2 instances, on-premises servers and virtual machines. It needs no SSH keys, no bastion host and no inbound security group rules. Access is controlled by IAM (identity and access management) policies and can be logged.

How it works

The SSM Agent on the instance makes an outbound connection to the Systems Manager service, either over the internet or through VPC (virtual private cloud) interface endpoints in a private subnet. A user with the ssm:StartSession permission runs aws ssm start-session --target i-0abc123 to get a shell. The AWS-StartPortForwardingSession document forwards a remote port, such as a database on 5432, to localhost. Idle sessions end after 20 minutes by default.

Why it matters in production

Removing port 22 and long-lived SSH keys closes a common attack path. Access becomes tied to individual IAM identities, which makes revoking it and auditing it simpler than tracking shared keys. Session logs can go to CloudWatch Logs or S3 for compliance reviews.

See also

• Bastion host

• Network address translation

• Infrastructure as code

On the One2N blog

• Accessing private EC2 instances without keys or passwords

• How to port-forward from EC2 instances without the need for opening any SSH ports or creating bastion hosts

• How we migrated 20k users from Azure to AWS with zero downtime

References

1. Origin of the term

2. AWS Systems Manager Session Manager (AWS documentation)