Session Manager

What it is
- A capability of AWS Systems Manager that gives a browser- or CLI-based shell into an EC2 instance or on-premises server.
Why it matters
- No SSH keys to manage or leak.
- No bastion host to run and pay for.
- No open inbound ports — no port 22 exposed; the connection is outbound from the SSM Agent to the Systems Manager endpoint.
How access works
- The SSM Agent (pre-installed on Amazon Linux, Ubuntu, and Windows AMIs) polls Systems Manager over HTTPS.
- Permissions come from AWS Identity and Access Management (IAM) policies, not OS user accounts or key pairs.
Auditing
- Every session start/end is logged to AWS CloudTrail.
- Full session command logs can stream to Amazon S3 or Amazon CloudWatch Logs.
Not to be confused with
- Run Command — fires a one-off command at a fleet without an interactive shell. Session Manager is an interactive terminal for a single node.
- A traditional bastion host / jump box — Session Manager replaces it.

Linked from