Connecting to EC2 with Session Manager (No SSH Required)

Opening a shell on an EC2 instance through Systems Manager's Session Manager, with no SSH keys, bastion host, or open port 22 required.

Takahiro Iwasa

2020-04-19

2 min read

Systems Manager - Session Manager provides shell access to EC2 instances without SSH:

• No SSH keys: Eliminates the need to manage and secure SSH keys.
• No bastion hosts: Removes the requirement for intermediary servers to access EC2 instances.
• No inbound rules on port 22: Improves security by avoiding open ports in your security group.

Building

Session Manager requires an IAM role with the AmazonSSMManagedInstanceCore policy attached to the EC2 instance (line 30).

1
AWSTemplateFormatVersion: 2010-09-09
2
Resources:
3
  EC2:
4
    Type: AWS::EC2::Instance
5
    Properties:
6
      IamInstanceProfile: !Ref InstanceProfile
7
      ImageId: ami-0f310fced6141e627
8
      InstanceType: t3.small
9
      SecurityGroups:
10
        - !Ref SecurityGroup
11

12
  InstanceProfile:
13
    Type: AWS::IAM::InstanceProfile
14
    Properties:
15
      Path: /
16
      Roles:
17
      - !Ref IamRole
18

19
  IamRole:
20
    Type: AWS::IAM::Role
21
    Properties:
22
      AssumeRolePolicyDocument:
23
        Version: 2012-10-17
24
        Statement:
25
          - Effect: Allow
26
            Principal:
27
              Service: ec2.amazonaws.com
28
            Action: sts:AssumeRole
29
      ManagedPolicyArns:
30
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
31
      RoleName: ec2-role
32

33
  SecurityGroup:
34
    Type: AWS::EC2::SecurityGroup
35
    Properties:
36
      GroupDescription: Example
37
      GroupName: ec2-security-group
38
      SecurityGroupIngress:
39
        - CidrIp: 0.0.0.0/0
40
          FromPort: 443
41
          IpProtocol: tcp
42
          ToPort: 443

Deploy the stack:

aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name ec2-session-manager \
  --capabilities CAPABILITY_NAMED_IAM

Testing

A session with the instance can be started with:

aws ssm start-session --target i-xxxxxxxxxxxxxxxxx

The output will indicate a successful login:

1
Starting session with SessionId: your-session-id
2
sh-4.2$

Cleaning Up

Delete the stack to remove the provisioned resources:

aws cloudformation delete-stack --stack-name ec2-session-manager

Conclusion

Attaching the AmazonSSMManagedInstanceCore managed policy to the EC2 instance role was enough to open a shell session with aws ssm start-session, with no SSH key pair or bastion host involved. That policy attachment is really the entire setup — the security group in this example only needs to allow outbound HTTPS rather than any inbound rule on port 22 — which is a meaningful reduction in what has to be managed and secured compared to a traditional SSH-based access pattern. The one prerequisite worth planning for is network reachability to the ssm, ec2messages, and ssmmessages endpoints: public subnets reach them without extra configuration, but private subnets need the corresponding VPC endpoints in place before the session will succeed.

About the author

Takahiro Iwasa

LinkedIn

GitHub

Software Developer

This blog shares technical notes from hands-on projects—architecture, implementation, and AWS service integrations.