How do I use Session Manager port forwarding without a bastion host to connect to my EC2 instance through RDP?

Short description

Use port forwarding with Session Manager to connect to your EC2 instance through RDP when you block inbound access to security groups. You don't need to open inbound ports or configure bastion hosts to use Session Manager port forwarding.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Prerequisites:

• You configured the required permissions for Session Manager.
• You installed the Session Manager plugin for the AWS CLI for your operating system (OS) on your local machine.
• AWS Systems Manager manages your instance. For more information, see Setting up managed nodes for AWS Systems Manager.
• You installed AWS Systems Manager Agent (SSM Agent) version 2.3.672.0 or later, and SSM Agent is running.If you didn't install a correct version of SSM Agent, then install the latest version on Linux instances and Windows instances.
• You configured your instance's OS to accept RDP connections on default port 3389.

Establish the port forwarding session

Use the AWS CLI to start a port forwarding session. If the connection is successful, then a message similar to the following example displays:

"Starting session with SessionId: 12345-01234567891011abc Port 55678 opened for sessionId 12345-01234567891011abcWaiting for connections..."

Note: You can't use the Start-SSMSession Cdmlet to establish a port forwarding session with Amazon Web Services Tools for PowerShell on Windows local machines.

Then, use a local RDP client to connect to your local port, so that Session Manager can forward traffic to the remote port 3389 on your instance. If the connection is successful, then a message similar to the following example displays:

"Connection accepted for session xxx-01234567891011abc"

If your port forwarding session fails to connect, then troubleshoot it.

End the port forwarding session

Be sure to end the port forwarding session when you connect to your instance through RDP. Complete the following steps:

1. Close the RDP session.
2. On the AWS CLI, press Ctrl + C to end the port forwarding session. Or use the AWS Systems Manager console to end the session.

If the session successfully ends, then a message similar to the following example displays:

"Terminate signal received, exiting. Exiting session with sessionId: 12345-01234567891011abc."

Troubleshoot the connection

To troubleshoot your port forwarding connection, take the following actions based on the error that you receive.

AccessDeniedException

Verify that the user that starts the session has the necessary permissions to start the session. Also verify that the instance's IAM role has the required permissions for Session Manager.

TargetNotConnected

Prerequisite: Check that you have the necessary permissions to access and view Fleet manager. For more information, see Controlling access to Fleet Manager.

This error indicates that you started a session on a managed node that isn't available or isn't correctly configured for Session Manager.

To resolve this error, open the Systems Manager Fleet Manager console, and then verify that the target node's status is Online. If the node's status is Online, then check that you correctly configured the target node for Session Manager. for instructions, see Managed node not available or not configured for Session Manager.

Session Manager plugin not found

Verify that you installed the Session Manager plugin on your local machine. For more information, see Install the Session Manager plugin for the AWS CLI.

RDP client can't connect

If your session connects successfully but the RDP client can't connect, then check whether you changed the default RDP port on your instance. Replace the portNumber parameter value with your value. For more information, see Check the RDP listener port on the Microsoft website.

Related information

Troubleshooting Session Manager