AWS for DevOps — SSM Session Manager

11.3 — SSM Session Manager

Session Manager lets you open a shell on your EC2 instances without SSH, without bastion hosts, and without opening port 22. All sessions are logged and auditable.

Real-World Analogy

Session Manager is like a secure video call into a locked room. Instead of giving out physical keys (SSH keys) and leaving doors open (port 22), you start a supervised video call that’s recorded. When the call ends, the door locks again.

How Session Manager Works

  Traditional SSH:
  ┌────────┐     port 22      ┌──────────┐
  │Engineer│────────────────→ │EC2 Instance│
  └────────┘  SSH key needed   └──────────┘
              Port 22 open
              No logging

  Session Manager:
  ┌────────┐     HTTPS       ┌─────────┐     SSM Agent    ┌──────────┐
  │Engineer│────────────────→│SSM Service│────────────────→│EC2 Instance│
  └────────┘  IAM auth       └─────────┘   Port 22 closed  └──────────┘
              No SSH key                    Session logged

Prerequisites

1. SSM Agent — Installed by default on Amazon Linux 2, Ubuntu 20.04+
2. IAM Role — EC2 instance must have AmazonSSMManagedInstanceCore policy
3. No inbound rules needed — Session Manager uses outbound HTTPS

# Verify SSM Agent is running on the instance
$ aws ssm describe-instance-information \
    --filters Key=InstanceIds,Values=i-0abc123def456
{
    "InstanceInformationList": [
        {
            "InstanceId": "i-0abc123def456",
            "PingStatus": "Online",
            "PlatformType": "Linux",
            "PlatformName": "Amazon Linux",
            "AgentVersion": "3.2.1"
        }
    ]
}

Starting a Session

# Start an interactive shell session
$ aws ssm start-session --target i-0abc123def456

Starting session with SessionId: engineer-abc123
sh-4.2$ whoami
ssm-user
sh-4.2$ hostname
ip-10-0-1-42.ap-south-1.compute.internal
sh-4.2$ exit
Exiting session with sessionId: engineer-abc123

Port Forwarding

Access services running on the instance without exposing ports:

# Forward local port 8080 to the instance's port 80
$ aws ssm start-session \
    --target i-0abc123def456 \
    --document-name AWS-StartPortForwardingSession \
    --parameters '{"portNumber":["80"],"localPortNumber":["8080"]}'

# Now access http://localhost:8080 to reach the instance's port 80

# Forward to an RDS instance through EC2 (tunnel)
$ aws ssm start-session \
    --target i-0abc123def456 \
    --document-name AWS-StartPortForwardingSessionToRemoteHost \
    --parameters '{"host":["prod-db.cluster-abc.rds.amazonaws.com"],"portNumber":["3306"],"localPortNumber":["3306"]}'

# Now connect to RDS via localhost:3306

Session Logging

Log all session activity to S3 and CloudWatch:

$ aws ssm update-document \
    --name SSM-SessionManagerRunShell \
    --document-version '$LATEST' \
    --content '{
      "schemaVersion": "1.0",
      "description": "Session Manager settings",
      "sessionType": "Standard_Stream",
      "inputs": {
        "s3BucketName": "my-session-logs-bucket",
        "s3KeyPrefix": "session-logs",
        "cloudWatchLogGroupName": "/aws/ssm/sessions",
        "cloudWatchEncryptionEnabled": true
      }
    }'

SSH vs Session Manager

Feature	SSH	Session Manager
Port 22 required	Yes	No
SSH keys to manage	Yes	No (uses IAM)
Bastion host needed	Usually	No
Session logging	Manual setup	Built-in
Audit trail	None	CloudTrail + session logs
Port forwarding	Yes	Yes
File transfer	SCP	S3 or port forwarding

Common Mistakes

Mistake	Why It Hurts	Fix
Missing IAM role on EC2	Session Manager can’t connect	Attach AmazonSSMManagedInstanceCore policy
Old SSM Agent	Compatibility issues	Update agent: yum install -y amazon-ssm-agent
Not enabling session logging	No audit trail of shell commands	Configure S3 + CloudWatch logging
Still opening port 22	Unnecessary attack surface	Remove SSH inbound rules; use Session Manager only

Quick Reference

Task	Command
Start session	aws ssm start-session --target INSTANCE_ID
Port forward	aws ssm start-session --target ID --document-name AWS-StartPortForwardingSession --parameters ...
List sessions	aws ssm describe-sessions --state Active
Terminate session	aws ssm terminate-session --session-id SESSION_ID
Check instance status	aws ssm describe-instance-information

---

Next → AWS Config