Secured IAM access related

To achieve a Zero Trust architecture for temporary, auditable instance access, you should completely avoid sharing SSH keys or opening inbound ports (such as TCP 22 or 3389) in your Security Groups. The most secure, native AWS solution to fulfill your requirements is combining AWS Systems Manager (SSM) Session Manager with its Just-in-Time (JIT) Node Access feature.

Here is how this addresses both of your requirements:

1. Time-Bound Access

You can use Systems Manager Just-in-Time (JIT) Node Access, a feature specifically designed to eliminate standing privileges.

• Approval Workflow: The system admin (Operator) submits an access request for the specific VM. You (or a designated Approver) review and approve the request.
• Enforced Time Limits: Access is strictly time-bound. You can define an approval policy that automatically terminates the session and revokes access exactly after your specified 1-hour window expires.
• Zero Trust Benefits: No static credentials are exchanged, no bastion hosts are required, and the admin only gains access after explicit authorization.

2. Auditing Activity

To have a non-repudiable audit trail of the admin's activities inside the VM, you must configure Session Manager Logging.

• Terminal Transcripts: Session Manager can be configured to capture the entire interactive shell session—recording every command executed and all terminal output. These transcripts are saved immutably to an Amazon S3 bucket or Amazon CloudWatch Logs.
• API Auditing: AWS CloudTrail automatically logs the StartSession API call. This provides a clear record of who initiated the session (their IAM identity), the target instance ID, and the exact timestamps of the session's start and end.

Summary of Setup Steps

1. Ensure your target VM has the SSM Agent installed and is assigned an IAM role containing the AmazonSSMManagedInstanceCore managed policy.
2. Enable Session Manager Logging to S3 or CloudWatch via the Systems Manager > Session Manager > Preferences console.
3. Configure a Just-in-Time access policy for your nodes to require approval and enforce the 1-hour maximum session duration.

See also:

• https://aws.amazon.com/blogs/mt/introducing-just-in-time-node-access-using-aws-systems-manager/
• https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-auditing.html