What is AWS Systems Manager Session Manager?

Session Manager is the part of AWS Systems Manager that lets you open a shell, forward a port or RDP to an EC2 instance without opening any inbound port, running a bastion host or handing out SSH keys. Access is granted and revoked with IAM policies, and every session can be logged to CloudTrail, S3 or CloudWatch Logs.

1. The problem it replaces

The traditional way to reach a server is to open port 22 or 3389, restrict it to a few IP addresses, and hope nobody's home IP changes. AWS describes the risk plainly: leaving inbound SSH and remote PowerShell ports open "greatly increases the risk of entities running unauthorized or malicious commands". The workaround — a bastion or jump box — becomes one more machine to patch, monitor and pay for.

Session Manager inverts the model. The instance runs the SSM Agent, which opens an outbound connection to the Systems Manager service. When you start a session, AWS authenticates you, checks your IAM permissions, and asks the agent to open a two-way channel. Nothing on the instance listens for you.

2. What you can do with it

Capability	What it means
Interactive shell	Bash on Linux/macOS, PowerShell on Windows Server, from the console or the AWS CLI.
Port forwarding	Redirect a port on the instance (3389 for RDP, 5432 for Postgres…) to a local port on your machine.
Port forwarding to a remote host	Reach a database or another server behind the instance, using it as a hop.
SSH over Session Manager	Use your normal `ssh`/`scp` with Session Manager as the transport.
Non-EC2 nodes	On-premises servers, VMs and edge devices registered with Systems Manager.

Traffic between your client and the instance is encrypted with TLS 1.2, requests are signed with SigV4, and you can add a KMS key for a second layer of encryption.

3. Why teams choose it

Centralised access control. IAM policies decide who can start a session and on which nodes — including temporary access for an on-call rotation.
No open inbound ports, no bastion, no SSH keys. Close 22 and 3389 entirely.
Logging. CloudTrail records every StartSession; session transcripts can stream to CloudWatch Logs or land in S3 (optionally KMS-encrypted). EventBridge can notify you when a session starts or ends.
Cross-platform. One tool for Windows, Linux and macOS nodes.
PrivateLink support. With VPC interface endpoints, instances need no internet access at all.

4. What it costs

"No additional charges for usage on Amazon EC2 instances." You pay for the instance and any CloudWatch Logs or S3 storage you enable. Hybrid and multicloud (non-EC2) nodes move to a per-session charge from 30 September 2026.

5. What it is not

It's not a VPN — it doesn't put your laptop on the VPC network.
It's not a public-facing gateway — every user still needs an AWS identity and IAM permission.
Shell sessions run as the ssm-user account the agent creates (with administrator rights by default); SSH-over-SSM sessions use the instance's normal user and key pair.

6. How Reach uses it

TYO Reach's Remote Targets for AWS drive Session Manager port forwarding for you: a team member clicks the instance in the Reach tray, signs in through AWS IAM Identity Center, and RDP or SSH opens on a local port — no CLI, no plugin, no access keys on the laptop.

Common questions

Do I still need a bastion host?

No. The instance connects out to the Systems Manager service; you connect to the service. Nothing needs to accept inbound connections from the internet, so the bastion has no job left to do.

Does Session Manager work for Windows?

Yes — Windows Server 2012 and later (not 2016 Nano). You get a PowerShell session, or you forward port 3389 and use your normal RDP client.

Can I restrict which instances someone can reach?

Yes. ssm:StartSession is granted per instance ARN, or by tag with the ssm:resourceTag/<key> condition — for example, only instances tagged Finance=WebServers.

Is the session encrypted?

Traffic is encrypted with TLS 1.2 between the client and the instance, and you can add KMS encryption of session data on top.