Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsYou can administer a private Amazon EC2 instance with AWS Systems Manager Session Manager while keeping inbound port 22 closed. Session Manager uses the SSM Agent on the instance to initiate communication with AWS; the instance still needs outbound HTTPS connectivity to Systems Manager endpoints, either through internet egress or private VPC endpoints.
How Session Manager connects without inbound SSH
An operator starts a session from the AWS console or AWS CLI. The SSM Agent on the managed instance initiates the connection to Systems Manager, so the normal Session Manager shell workflow does not require an inbound firewall rule for SSH. AWS describes the model this way: “SSM Agent initiates all connections to the Systems Manager service in the cloud.” AWS Systems Manager VPC endpoint guidance.
As an Amazon Associate I earn from qualifying purchases.
Closing port 22 is not the same as disconnecting the instance from the network. The agent must be able to reach the required regional Systems Manager endpoints over HTTPS (port 443). That path can use outbound internet connectivity or private interface endpoints.
What the instance and operator need
A supported operating system and a running SSM Agent
The EC2 operating system must be supported by Session Manager, and SSM Agent must be installed and running. AWS lists agent version 3.0.222.0 or later for SSH sessions and port forwarding, and version 3.0.284.0 or later for streaming session data to CloudWatch Logs. These are feature-specific minimums; check the current Session Manager prerequisites before deployment, and keep the agent updated.
#1 Best Overall
An instance role for Systems Manager
Attach an IAM role to the EC2 instance so the agent can communicate with Systems Manager. AWS’s EC2 connection guidance identifies the AmazonSSMManagedInstanceCore policy as an example. If you configure S3 or CloudWatch Logs session logging, the role and destination policies also need the permissions required for that configuration. A custom policy should be checked against AWS’s current permissions guidance.
Operator permissions
The instance role and the operator’s IAM permissions serve different purposes. The role lets the node communicate with AWS; operator policies determine who can start sessions and which managed nodes they may access. Scope access to the intended instances and session types, and decide explicitly whether operators may start ordinary shell sessions, SSH tunnels, or port-forwarding sessions. See AWS’s Session Manager overview for the access model.
Choose a network path for a private instance
| Network design | What to configure | Key consideration |
|---|---|---|
| Outbound internet connectivity | Allow outbound HTTPS (port 443) from the instance to the required regional ssm, ssmmessages, and ec2messages endpoints. |
The instance needs outbound service connectivity, but Session Manager does not require inbound SSH. Consult the prerequisites and endpoint list. |
| PrivateLink interface VPC endpoints | Create the Systems Manager interface endpoints needed in the VPC and permit HTTPS from the managed instance subnet in the endpoint security group. | Instances can use this Systems Manager path without internet access, an internet gateway, or a NAT device. DNS, endpoint security groups, and endpoint policies must be configured correctly. See AWS VPC endpoint guidance and PrivateLink setup. |
With custom DNS, configure the required forwarding to Amazon DNS. Add endpoints for any other services your configuration depends on: for example, an S3 or CloudWatch Logs endpoint when session preferences send logs to those destinations, or a KMS endpoint when the design uses KMS encryption. Missing optional-service connectivity can break logging or encryption-related behavior even when the core Systems Manager connection works. AWS documents these considerations in its VPC endpoint guidance and troubleshooting guide.
Configure access, logging, and encryption
Set operator boundaries before enabling sessions
Use IAM to grant session access only to the operators and managed nodes that need it. Review permissions for specific session documents and for SSH or port-forwarding features separately from general shell access. This makes the access boundary explicit rather than treating every session type as equivalent.
Choose the session data you need to retain
Session Manager can send supported session data to an S3 bucket or CloudWatch Logs log group, and it offers KMS encryption options. Configure destination policies and the necessary permissions; for instances without internet egress, make sure the relevant service endpoints are reachable. AWS’s session logging documentation describes supported logging options.
Session Manager cannot log session contents for SSH and port-forwarding sessions. SSH encrypts its data inside the TLS connection, and Session Manager tunnels that traffic rather than exposing the contents for logging. If an auditable transcript is required, account for this limitation when choosing between a Session Manager shell and a tunneled connection. See AWS’s logging guidance and SSH configuration documentation.
Implementation sequence
- Check the node: confirm the operating system is supported, SSM Agent is installed and running, and its version meets the needs of the features you plan to use.
- Attach the instance role: provide Systems Manager permissions, using
AmazonSSMManagedInstanceCoreas AWS’s documented example or a validated least-privilege custom policy. Add any permissions required for configured logging destinations. - Provide endpoint connectivity: allow outbound HTTPS to the required regional endpoints, or create the corresponding interface VPC endpoints. Verify endpoint security-group ingress, DNS resolution, and endpoint policies.
- Scope operator IAM: authorize the intended operators to start sessions only on the appropriate managed nodes and to use only the session types they need.
- Configure observability: select S3 or CloudWatch Logs where appropriate, set permissions and any needed private endpoints, and decide whether the inability to log SSH and port-forwarding contents is acceptable.
- Start a test session: use the Systems Manager or EC2 console, or start a session with the AWS CLI. Confirm that the node is online as a managed node and that the chosen session and logging behavior match the design. AWS’s EC2 connection guide covers the connection options.
Troubleshoot a node that cannot start a session
- Check managed-node status: verify the instance is registered and online in Systems Manager, the instance role has the necessary permissions, and SSM Agent is running and current.
- Check the network path: verify outbound HTTPS to the required regional endpoints or, for PrivateLink, the endpoint configuration, security-group rules, endpoint policies, and DNS.
- Check logging dependencies: if session logging is enabled, confirm that the S3 bucket or CloudWatch Logs group exists and allows the configured writes. In a private subnet, verify connectivity to the destination service endpoint as well.
- Check feature requirements: if the session starts but a feature does not work, verify the agent minimum for that feature and the required local AWS CLI components for the operator’s workflow. AWS’s Session Manager troubleshooting guide covers common failures.
Choose between a shell and a tunnel
A standard Session Manager shell is the clearest fit when operators need an interactive command line and you want Session Manager to log supported session data. SSH over Session Manager and port forwarding can preserve workflows that depend on SSH or a forwarded port without opening inbound port 22 on the instance, but Session Manager cannot record the contents of those tunneled sessions. In either case, access is governed through IAM and the instance still needs its agent, role, and network path to AWS.
Recommended Free Tools
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
