6.5 Secure Administrative Access: Session Manager & EC2 Instance Connect

6.5 Secure Administrative Access: Session Manager & EC2 Instance Connect

Administrators still need shells on instances to troubleshoot, patch, and investigate. Skill 3.2.5 tests how you provide that access without inbound SSH or RDP from the internet, without long-lived SSH keys, and with every session tied to an IAM identity and logged. The two services named in the exam guide are AWS Systems Manager Session Manager and EC2 Instance Connect.

---

AWS Systems Manager Session Manager

Session Manager opens an interactive shell (or a port-forwarding tunnel) through the SSM Agent, which makes outbound HTTPS (443) connections to Systems Manager. The instance needs no inbound ports, no public IP address, no bastion host, and no SSH keys.

Requirements

• SSM Agent installed and running (preinstalled on Amazon Linux, Ubuntu Server, and Windows Server AMIs from AWS).
• Instance permissions: an instance profile with the AmazonSSMManagedInstanceCore managed policy, or the account-level Default Host Management Configuration, which gives instances Systems Manager permissions without an instance profile (IMDSv2 required).
• Network path: outbound HTTPS to the Systems Manager endpoints. For instances in private subnets without a NAT gateway, create interface VPC endpoints for ssm and ssmmessages (older SSM Agent versions also use ec2messages), plus kms if sessions are KMS-encrypted and logs or an S3 gateway endpoint for session logging.

Controlling Who Can Start Sessions

IAM decides who can open a session to which instance. A common pattern allows sessions only to instances tagged for the user's team and only with approved session documents:

{
  "Effect": "Allow",
  "Action": "ssm:StartSession",
  "Resource": "arn:aws:ec2:us-east-1:111122223333:instance/*",
  "Condition": {
    "StringEquals": { "ssm:resourceTag/Team": "payments" },
    "BoolIfExists": { "ssm:SessionDocumentAccessCheck": "true" }
  }
}

Grant ssm:TerminateSession and ssm:ResumeSession only for the user's own sessions by matching the session's owner, so one administrator can't take over another's session.

Session Preferences (Account and Region Settings)

CloudTrail records every StartSession, TerminateSession, and ResumeSession call, so each session is attributable to an IAM principal even when many people share an OS account.

Port Forwarding and SSH Through Session Manager

• AWS-StartPortForwardingSession forwards a local port to a port on the instance (for example, RDP on 3389).
• AWS-StartPortForwardingSessionToRemoteHost uses the instance as a jump host to a private endpoint, such as an Amazon RDS database, without exposing the database.
• AWS-StartSSHSession tunnels SSH through Session Manager; restrict it if you want only audited shell sessions, because SSH tunneling can bypass session logging.

---

EC2 Instance Connect

EC2 Instance Connect keeps SSH but removes long-lived keys. An authorized user calls ec2-instance-connect:SendSSHPublicKey, which places a one-time public key in instance metadata for 60 seconds; the user must connect with the matching private key within that window. IAM can restrict the OS user with the ec2:osuser condition key and restrict instances by tag. The instance needs the EC2 Instance Connect package (included in Amazon Linux 2, Amazon Linux 2023, and Ubuntu AMIs).

Connecting from the console to a public instance requires the security group to allow SSH from the EC2 Instance Connect service's IP address range for the Region.

EC2 Instance Connect Endpoint (EICE)

An EC2 Instance Connect Endpoint reaches instances in private subnets over SSH (22) or RDP (3389) without public IP addresses, internet gateways, or bastion hosts. You create the endpoint in a subnet with its own security group, and the instance's security group allows traffic from the endpoint's security group. Users call ec2-instance-connect:OpenTunnel, which IAM can restrict with the condition keys ec2-instance-connect:remotePort, ec2-instance-connect:privateIpAddress, and ec2-instance-connect:maxTunnelDuration (up to 3,600 seconds).

---

Choosing an Approach

---

Specialty Exam Pitfalls

1. Opening port 22 to 0.0.0.0/0 "for Session Manager": Session Manager needs no inbound rules; outbound HTTPS is enough.
2. Private subnet with no path to Systems Manager: Without a NAT gateway or interface endpoints, the instance never registers and sessions fail.
3. Unencrypted or missing session logs: Configure KMS encryption and logging in Session Manager preferences to meet audit requirements.
4. Shared SSH keys on a bastion: Replace them with Session Manager or EC2 Instance Connect so each session maps to an IAM identity.