Encryption of SSM session data using KMS
Published: 2021-06-11 13:46:40

---
title: Encryption of SSM session data using KMS
published: true
date: 2021-06-11 11:00:00 UTC
tags: 
canonical_url: https://globaldatanet.com/blog/encryption-of-ssm-session-data-using-kms
---

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hdslaho1oreu5cnv32fh.png)




Connecting to your EC2 Instances using Session Manager is for years already a default. However most of the users are just using the defaultTLS 1.2 encryption that AWS already provides by default. For most of the usecases this is ok, but sometimes it is required to encrypt your sessions with your own KMS Keys. Encrypting session data with your key also enables sessions to handle confidential data interactions, such as password resets, and further improves your security posture when using Systems Manager Session Manager. To use the option to encrypt session data using a key created in AWS KMS, version 2.3.539.0 or later AWS Systems Manager SSM Agent must be installed on the managed instance.

In addition i would also recommend to log the session data either to S3 or to CloudWatch and to encrypt the session data which is logged to the destination using your own KMS Key. In the following post I will explain how to automatically configure the SSM default settings to secure your session data using your own KMS key.

![Architecture](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qjl5u6inhj0gmolqutex.png)




### Setup
1. Set up the required KMS Keys using this [template](https://gist.github.com/daknhh/532b542d650e0eebbe1f3f95bd3a4cff) using StackSet or Stack - this template will create the needed KMS Keys for SSM and CloudWatch with permissions.
2. Create a LambdaLayer with `boto3` or use a [prebuild layer.](https://github.com/keithrozario/Klayers)
3. Deploy the following [template](https://gist.github.com/daknhh/031fa70fa4c7ccd3410ed12add3511ef) using StackSet or Stack - the template which I provided will configure your Session Manager. 

After successfull deployment:

![Session Manager Settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rqv2egqg973tlu6cppm8.jpg)



4. Optionally secure CloudWatch LogGroup using SCPs.
Since the CloudWatch LogGroup from Session Manager will contain sensitve data, I would recommend to secure the LogGroup using SCPs so that only a few people from your audit team can read them.

```json
{
  "Version": "2012-10-17",
  "Statement": [
{
      "Sid": "CloudWatchLogsDeny",
      "Effect": "Deny",
      "Action": [
        "logs:DescribeLogStreams"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/ssm/SessionManagerLogGroup:*"
      ],
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:role/AuditRole"
          ]
        }
      }
    }
  ]
}
```

### Usage
Now you can either use your browser or CLI to connect to your instance using the Session Manager and during the session all data will be encrypted using your own KMS Key. 

ℹ️ You can not use `aws ssm start-session` with the `--profile` flag that needs a MFA because there is an [🚨 issue](https://github.com/aws/aws-cli/issues/6218) right now that the command doens't ask for MFA. 

Workaround: Using [awsume](https://awsu.me/) solves this problem.