Unable to Connect to EC2 Instance via SSM Session Manager

Hello Sandeep.

Verify IAM Role Permissions:

Ensure that the IAM role attached to your EC2 instance has the necessary permissions to interact with Systems Manager. The required permissions include AmazonSSMManagedInstanceCore managed policy or equivalent permissions.

You can attach the managed policy AmazonSSMManagedInstanceCore to your IAM role to grant the necessary permissions for Systems Manager.

Check Instance Status: Make sure that your EC2 instance is running and reachable over the network. If the instance is stopped or terminated, you won't be able to connect to it via Session Manager.

Verify that the instance is in a state where it can accept SSM connections. Instances should have the SSM agent installed and running. You can check the SSM agent status on the instance.

Security Group Configuration: Check the security group associated with your EC2 instance to ensure that it allows inbound and outbound traffic on the necessary ports for Session Manager. Inbound traffic on port 443 (HTTPS) is required for Session Manager connections.

Ensure that the security group allows traffic from the subnet where your Session Manager-managed instances are located.

Subnet Routing: Verify that the subnet where your EC2 instance resides has a route to the internet gateway (if the instance needs to communicate with Systems Manager endpoints over the internet). Instances in private subnets might require a NAT gateway or NAT instance for outbound internet access.

SSM Agent Configuration: Check the SSM agent logs on the EC2 instance for any errors or warnings that might indicate issues with the agent configuration or connectivity. The logs are typically located in /var/log/amazon/ssm/amazon-ssm-agent.log.

Instance Role Association: Ensure that the EC2 instance has the correct IAM role associated with it. You can verify this by checking the instance details in the EC2 console or by using the AWS CLI command aws ec2 describe-instances.

Check Session Manager Configuration: Verify that Session Manager is enabled in your AWS account and is configured correctly. You can check the Session Manager settings in the AWS Systems Manager console.

Network ACLs and VPC Endpoints:

If you're using network ACLs or VPC endpoints, ensure that they are configured to allow traffic to and from the Systems Manager endpoints. Session Manager communicates with Systems Manager endpoints in the AWS cloud.