Connecting to EC2 with Session Manager (No SSH Required)

Opening a shell on an EC2 instance through Systems Manager's Session Manager, with no SSH keys, bastion host, or open port 22 required.

Takahiro Iwasa

2020-04-19

2 min read

AWS Systems Manager Session Manager provides shell access to EC2 instances without SSH:

• No SSH keys: Eliminates the need to manage and secure SSH keys.
• No bastion hosts: Removes the requirement for intermediary servers to access EC2 instances.
• No inbound rules on port 22: Improves security by avoiding open ports in your security group.

Configuration

To use Session Manager, attach an IAM role containing the AmazonSSMManagedInstanceCore policy to the EC2 instance (line 30).

1
AWSTemplateFormatVersion: 2010-09-09
2
Resources:
3
  EC2:
4
    Type: AWS::EC2::Instance
5
    Properties:
6
      IamInstanceProfile: !Ref InstanceProfile
7
      ImageId: ami-0f310fced6141e627
8
      InstanceType: t3.small
9
      SecurityGroups:
10
        - !Ref SecurityGroup
11

12
  InstanceProfile:
13
    Type: AWS::IAM::InstanceProfile
14
    Properties:
15
      Path: /
16
      Roles:
17
      - !Ref IamRole
18

19
  IamRole:
20
    Type: AWS::IAM::Role
21
    Properties:
22
      AssumeRolePolicyDocument:
23
        Version: 2012-10-17
24
        Statement:
25
          - Effect: Allow
26
            Principal:
27
              Service: ec2.amazonaws.com
28
            Action: sts:AssumeRole
29
      ManagedPolicyArns:
30
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
31
      RoleName: ec2-role
32

33
  SecurityGroup:
34
    Type: AWS::EC2::SecurityGroup
35
    Properties:
36
      GroupDescription: Example
37
      GroupName: ec2-security-group
38
      SecurityGroupIngress:
39
        - CidrIp: 0.0.0.0/0
40
          FromPort: 443
41
          IpProtocol: tcp
42
          ToPort: 443

Deploy the stack:

aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name ec2-session-manager \
  --capabilities CAPABILITY_NAMED_IAM

Testing

Start a session with the instance by running:

aws ssm start-session --target i-xxxxxxxxxxxxxxxxx

The output will indicate a successful login:

1
Starting session with SessionId: your-session-id
2
sh-4.2$

Cleaning Up

Delete the stack to remove the provisioned resources:

aws cloudformation delete-stack --stack-name ec2-session-manager

Conclusion

After attaching the AmazonSSMManagedInstanceCore managed policy to the EC2 instance role, you can open a shell with aws ssm start-session without an SSH key pair or bastion host. No inbound rule on port 22 is required, reducing the number of access credentials and network paths that must be managed compared with SSH-based access.

The instance must be able to reach the ssm, ec2messages, and ssmmessages endpoints. Instances without internet access need the corresponding VPC endpoints before a session can be established.

About the author

Takahiro Iwasa

LinkedIn

GitHub

Software Developer

This blog shares technical notes from hands-on projects—architecture, implementation, and AWS service integrations.