Back to posts
Connecting to EC2 with Session Manager (No SSH Required)

Connecting to EC2 with Session Manager (No SSH Required)

This note describes how to use Systems Manager - Session Manager.

Takahiro Iwasa
2 min read

This note describes how to use Systems Manager - Session Manager.

  • No SSH keys: Eliminates the need to manage and secure SSH keys.
  • No bastion hosts: Removes the requirement for intermediary servers to access EC2 instances.
  • No inbound rules on port 22: Improves security by avoiding open ports in your security group.

Building

To use Session Manager, you need an IAM role with the AmazonSSMManagedInstanceCore policy attached to your EC2 instance (line 30).

template.yaml
AWSTemplateFormatVersion: 2010-09-09
Resources:
  EC2:
    Type: AWS::EC2::Instance
    Properties:
      IamInstanceProfile: !Ref InstanceProfile
      ImageId: ami-0f310fced6141e627
      InstanceType: t3.small
      SecurityGroups:
        - !Ref SecurityGroup


  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref IamRole


  IamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      RoleName: ec2-role


  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Example
      GroupName: ec2-security-group
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443
ℹ️ Note

If your EC2 instances are in private subnets, set up the following VPC endpoints:

  • com.amazonaws.region.ssm
  • com.amazonaws.region.ec2messages
  • com.amazonaws.region.ssmmessages

Refer to the official knowledge for more details.

Deploy the stack using the following command:

Terminal window
aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name ec2-session-manager \
  --capabilities CAPABILITY_NAMED_IAM

Testing

To start a session with your instance, run the following command:

Terminal window
aws ssm start-session --target i-xxxxxxxxxxxxxxxxx

The output will indicate a successful login:

Starting session with SessionId: your-session-id
sh-4.2$

Cleaning Up

Clean up all the AWS resources provisioned during this example with the following command:

Terminal window
aws cloudformation delete-stack --stack-name ec2-session-manager
Back to posts

Related posts

About the author

Takahiro Iwasa

Takahiro Iwasa

Software Developer

This blog shares technical notes from hands-on projects—architecture, implementation, and AWS service integrations.