How to set up Session Manager and enable SSH over SSM
Tags: aws, ec2, security
Published: 2022-01-11 18:12:58

This is a quick guide on how to set up sessions manager on your EC2 instance and enable SSH connections through SSM.

## Setting up sessions manager on EC2 instance

####1. Create IAM instance profile to allow Sessions Manager to connect to your instance (this is not enabled by default)

You can do that either by creating a new IAM role with Session Manager permissions or by adding inline policy permissions to an existing role already attached to our instance.
 
**To create/add instance profile:**
- Go to IAM and click on Create role
- Select EC2 as trusted entity.
![EC2 truested entity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m0bf29z5yh4x03edctyl.png)
- Add _AmazonSSMManagedInstanceCore_ policy to your role or _AmazonSSMFullAccess_ if you require to grant all Systems Manager permissions and click next.
![Adding AmazonSSMManagedInstanceCore permission to a new role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9j8d5l58e0k2tcbbtttw.png)
- Add tags and then click _Create role_.

- To add SSM permissions to an existing role, find the role that is attached to the instance, and then [add SSM permissions as an inline policy](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-add-permissions-to-existing-profile.html).


####2. Next add newly created role as your instance profile:


- Go to EC2 instances, select the instance you would like to enable SSM on.
- Click on Actions, select Security, and then Modify IAM role![Modifying IAM role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e1sl0szr2ihpyi2pm74u.png)
- Next select IAM role we have created in the previous step![Selecting IAM role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j7yso548cptfa1p6jgpg.png)

####3. You can now connect to your instance through Session Manager.![Connect to your instance!](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qleteddomsmwvuo0u88n.png)
 

Your can find out more information about EC2 instance profiles and IAM roles for SSM [over here.](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-instance-profile.html)

## Enabling SSH over SSM from your local machine

First of all we need to make sure we meet all the prerequisites:
1. Have installed latest[aws-cli](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)installed.
2. Install [Session Manager plugin](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html)on the machine you want to connect to your instance from.
3. Make sure your instance has latest SSM agent installed [](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-manual-agent-install.html)
4. Update local .ssh configuration on your machine.

Windows (usually located at: `C:\Users\username\.ssh\config`):
```
# SSH over Session Manager
host i-* mi-*
    ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
```
Mac (usually located at: `~/.ssh/config`):
```
# SSH over Session Manager
host i-* mi-*
    ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
```

5. Add permissions to role/user that you are using to connect to the console. 

You can use policy below to allow SSH connections through Sessions Manager.
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ssm:StartSession",
            "Resource": [
                "arn:aws:ec2:region:987654321098:instance/i-02573cafcfEXAMPLE",
                "arn:aws:ssm:*:*:document/AWS-StartSSHSession"
            ]
        }
    ]
}
```

Now, after assuming your chosen role/connecting through command line to AWS, you can connect to your instance through SSH over SSM by running this command:

`aws ssm start-session --target i-02573cafcfEXAMPLE --region your-chosen-region`.

You can remove any port 22 access in your node's security groups - this will no longer be needed to connect to your instance.

Any further reading about this, make sure to check [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html) about this.

_Note that you can make sure that your instance has the latest SSM agent installed, by [Automating Updates to SSM Agent.](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-automatic-updates.html)_