How do I use Session Manager to control access to my instances?

Short description

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Use Session Manager to manage Amazon Elastic Compute Cloud (Amazon EC2) instances or on-premises instances. Session Manager connects through a browser-based shell, or through the AWS CLI.

Use Identity and Access Management (IAM) policies to control the users who can use Session Manager to access your instance. The IAM policy also controls the API actions that the users can perform.

Prerequisites:

• Complete the Session Manager prerequisites.
• Verify or create an IAM instance profile with Session Manager permissions.

Resolution

To allow users to connect to Session Manager, use the example JSON document at Example 2: Restrict access to specific managed nodes to create an IAM policy. The IAM policy that grants StartSession access to the IAM user you specify.

Note: The Amazon Resource Name (ARN) in the example policy uses the AWS Region us-east-1 and includes placeholders for the instance ID and account ID. Replace instance ID with your instance's ID number. Replace account ID with your AWS account.

Then, attach the IAM policy to the user that must connect to Session Manager.

Use the AWS CLI to connect to Session Manager

Prerequisite: Install the Session Manager plugin for the AWS CLI.

Run the following start-session command to connect to Session Manager:

aws ssm start-session --target instance-id

Note: Replace instance-id with the instance ID that the user wants to start a session.

Start a session with Amazon EC2

To allow a user to start a session with Amazon EC2 in the AWS Management Console, console, attach the following AWS managed policies to that user:

• AmazonSSMReadOnlyAccess
• AmazonEC2ReadOnlyAccess

Related information

Additional sample IAM policies for Session Manager

AWS managed policies for AWS Systems Manager

Start a session

How AWS Systems Manager works with IAM

Systems Manager IAM rolesAWS managed policies for AWS Systems Manager