Connecting to your AWS instances with TYO Reach

Give your team — including external contractors — one-click RDP/SSH access to EC2 instances in your AWS account, through AWS's own identity-aware tunnelling. No VPN, no public IPs, no bastion host to run or maintain.

Throughout this document, "Reach" refers to TYO Reach.

1. How it works (30-second version)

User's laptop ──(Reach client)──► AWS IAM Identity Center ──► your EC2 instance
                                  (SSM Session Manager, or EC2 Instance Connect Endpoint)

The user clicks a machine in the Reach tray and signs in with your organisation's AWS IAM Identity Center (AWS SSO).
AWS checks they're allowed (IAM), enforces MFA / your Identity Center policies, and issues short-lived credentials (STS) for the tunnel.
Reach binds a local port and launches RDP or SSH to it.

AWS enforces all access and identity. Reach provides the one-click client and the audit trail. Traffic goes directly from the user to AWS to your instance — it never passes through Reach's servers (so it's also outside any Reach data allowance, and there's no third party in your data path).

Reach supports two AWS connection methods — pick whichever fits your instance:

Method	Backend	Best for
SSM Session Manager (recommended)	`aws-ssm`	Lowest friction — no public IP, no extra network resource, no security group change.
EC2 Instance Connect Endpoint (EICE)	`aws-eice`	Instances that can't or don't run the SSM Agent.

Neither method has a per-use AWS fee — you pay only for the instance and network egress you already pay for.

2. What your AWS admin sets up (one-time, per instance)

2.1 SSM Session Manager (recommended)

The instance must be SSM-managed: the SSM Agent running, and an instance profile attached with the AmazonSSMManagedInstanceCore policy.
Grant the signing-in identity (or their Identity Center permission set) IAM permission to start the tunnel:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "ssm:StartSession",
    "Resource": [
      "arn:aws:ec2:REGION:ACCOUNT_ID:instance/INSTANCE_ID",
      "arn:aws:ssm:REGION::document/AWS-StartPortForwardingSession"
    ]
  }]
}

No public IP, no inbound security group rule, and nothing exposed to the internet — the tunnel is brokered entirely by the SSM service.

2.2 EC2 Instance Connect Endpoint (alternative)

If SSM isn't available on an instance, use an EICE instead:

Create an EC2 Instance Connect Endpoint in the instance's VPC/subnet.
Grant the signing-in identity IAM permission:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ec2-instance-connect:OpenTunnel", "ec2:Describe*"],
    "Resource": "*"
  }]
}

Add a security group rule allowing the EICE to reach the instance on the port you serve. EICE only supports port 22 (SSH) or 3389 (RDP).

2.3 Set up AWS IAM Identity Center sign-in

Reach signs users in through your AWS IAM Identity Center (AWS SSO) using the device-authorization flow, then exchanges it for short-lived STS credentials — no long- lived AWS access keys ever touch the user's machine. You'll need:

Your Identity Center start URL (looks like https://d-xxxxxxxxxx.awsapps.com/start).
Your Identity Center region.
A permission set granting the IAM permissions from 2.1 and/or 2.2 to the users or groups who should get access.

For unattended/headless connections (a service account rather than a person), use a service principal with static credentials scoped the same way instead of Identity Center.

2.4 Give the user a way to log into the OS

The AWS side controls the tunnel; the instance still checks the login — a Windows username/password (RDP) or OS-level SSH key/credentials (SSH). These are separate from the IAM grant above.

That's the entire AWS side. No public IP, no bastion, nothing exposed to the internet — the tunnel is reachable only through AWS's own service, only by the identities you named.

3. What gets configured in Reach (per instance)

An admin adds a Remote target in the Reach dashboard's Targets tab:

Field	SSM (`aws-ssm`)	EICE (`aws-eice`)
Backend	`aws-ssm`	`aws-eice`
Region	your AWS region (e.g. `ap-southeast-2`)	same
Instance ID	the EC2 instance id (e.g. `i-0abc123456789def0`)	same
EICE endpoint ID	— (not used)	the Instance Connect Endpoint id (e.g. `eice-0abc123456789def0`)
Port	`3389` (RDP) or `22` (SSH)	`3389` or `22` only
Protocol	`rdp` / `ssh`	`rdp` / `ssh`

Enabled targets sync to every member of your organisation with the desktop client automatically.

4. What the end user does

Install the Reach desktop client (Windows / macOS / Linux).
Sign into Reach.
Open the tray → Remote targets → click the instance.
First time only: a browser opens to sign in through AWS IAM Identity Center — use the identity that was granted access (2.3). Approve.
Reach opens the tunnel and launches RDP/SSH automatically. Subsequent connects are one click (the AWS sign-in is cached until it expires).

No AWS access keys, no CLI, nothing for the end user to configure.

5. Security & governance

Access is AWS's to grant and revoke. Remove the permission set assignment (2.3) or the underlying IAM permission and the person loses access immediately — nothing lingers on their machine.
Least privilege: scope permission sets to specific instances or resource tags rather than the whole account.
MFA / Conditional Access: enforced by your Identity Center policies. Reach rides on top — it can't bypass them.
Audit: SSM sessions and EICE tunnels appear in your AWS CloudTrail; Reach can additionally record a per-connection audit trail on the Reach side.
Data path: user ↔ AWS ↔ instance. Reach is never in the traffic path.

6. Troubleshooting

Symptom	Cause / fix
AWS sign-in succeeds, then no connection	The permission set is missing `ssm:StartSession` (2.1) or the EICE permissions (2.2), or the target instance ID/region is wrong.
Works over SSM but not EICE (or vice versa)	Confirm the target's Backend field matches the connection method you actually set up on that instance.
"Connection refused" / times out at the instance	For EICE: the security group doesn't allow the endpoint to reach the port. For SSM: the SSM Agent isn't running or the instance profile is missing.
RDP/SSH opens but the login is rejected	That's the OS credential (2.4), separate from the AWS/IAM grant.
Target doesn't appear in the tray	The user isn't signed into Reach, or your organisation isn't on a Team plan.
Wrong machine reached	Check Region / Instance ID (and Endpoint ID for EICE) in the Reach target config (section 3).