EC2 Instance Connect vs Instance Connect Endpoint vs Session Manager
AWS has three built-in ways to reach an instance without a bastion. They overlap, but each solves a different problem: EC2 Instance Connect replaces long-lived SSH keys, EC2 Instance Connect Endpoint (EICE) replaces the public IP, and Session Manager replaces SSH itself.
1. The three options in one table
| EC2 Instance Connect | Instance Connect Endpoint (EICE) | Session Manager | |
|---|---|---|---|
| What it does | Pushes a one-time SSH public key to the instance via IAM | Identity-aware TCP proxy into your VPC | Agent-based shell / port forwarding brokered by AWS |
| Instance needs | EC2 Instance Connect installed (Linux; on most AWS AMIs) | Nothing extra — plain TCP to 22 or 3389 | SSM Agent + instance profile + endpoint reachability |
| Public IP required | Yes for the console; private IPs need an EICE or network path | No | No |
| Inbound security-group rule | Yes (22 from your IP or the EIC service range) | Yes, from the endpoint's security group only | No |
| Protocols | SSH | SSH (22) and RDP (3389) | Shell, any port via forwarding, SSH-over-SSM |
| Windows | No (Linux only) | Yes, RDP via tunnel | Yes, PowerShell or forwarded RDP |
| Session logging | CloudTrail (API call) | CloudTrail (every tunnel attempt) | CloudTrail + optional full transcript to S3/CloudWatch |
| Extra cost | None | None (cross-AZ data transfer applies) | None on EC2 |
2. EC2 Instance Connect — ephemeral SSH keys
When you connect through the console or the ec2-instance-connect CLI, "the EC2
Instance Connect API automatically pushes an SSH public key to the instance metadata
where it remains for 60 seconds". An IAM policy (ec2-instance-connect:SendSSHPublicKey,
scoped by ec2:osuser) authorises the push; the instance's SSH daemon picks the key up.
# Let AWS pick the path (public IP → EICE → IPv6)
aws ec2-instance-connect ssh --instance-id i-1234567890example
# Push your own key, then ssh normally within 60 seconds
aws ec2-instance-connect send-ssh-public-key \
--region ap-southeast-2 --availability-zone ap-southeast-2a \
--instance-id i-1234567890example --instance-os-user ec2-user \
--ssh-public-key file://my_key.pub
ssh -o "IdentitiesOnly=yes" -i my_key ec2-user@<public-dns>
Use it when you already run SSH and simply want to stop distributing key pairs. The console path still needs a public IPv4/IPv6 address on the instance.
3. EC2 Instance Connect Endpoint — no public IP
An EICE is "an identity-aware TCP proxy": you create one per VPC (in one subnet), and AWS "establishes a private tunnel from your computer to the endpoint using the credentials for your IAM entity". Instances keep private IPs only; the VPC needs no internet gateway.
# SSH through the endpoint
aws ec2-instance-connect ssh --instance-id i-1234567890example --connection-type eice
# Or open a raw tunnel and use any client (RDP: remote port 3389)
aws ec2-instance-connect open-tunnel \
--instance-id i-1234567890example --remote-port 3389 --local-port 5555
# then RDP to localhost:5555
Limits worth knowing: one endpoint per VPC and per subnet, 20 concurrent
connections per endpoint, tunnels last at most 1 hour, only management traffic
(bulk transfer is throttled), and the IAM OpenTunnel action can be conditioned on
remotePort, privateIpAddress and maxTunnelDuration. The instance's security group
must allow 22/3389 from the endpoint's security group (or the VPC CIDR).
4. Session Manager — no SSH at all
Session Manager needs the SSM Agent and an instance profile, but in return the instance opens no inbound port whatsoever — the agent connects out to the service. You get a browser or CLI shell, port forwarding for RDP and databases, and optional full session transcripts. Details in What is Session Manager? and Session Manager setup.
5. Decision guide
| You want… | Use |
|---|---|
To keep using ssh/scp but stop managing key pairs | EC2 Instance Connect |
| SSH or RDP to instances with no public IP, without installing an agent | Instance Connect Endpoint |
| Zero inbound ports, Windows PowerShell access, port forwarding to RDS/other hosts, session transcripts | Session Manager |
| Instances that can't run the SSM Agent (minimal or third-party images) | Instance Connect Endpoint |
| Hybrid / on-premises nodes | Session Manager (hybrid activation) |
Many teams run both: Session Manager as the default, EICE as the fallback for instances where the agent isn't an option.
Common questions
Can Instance Connect reach an instance with only a private IP?
Through the console, no — it needs a public IP. Through the CLI with --connection-type eice, or by pushing your own key and having a network path (VPN, Direct Connect,
peering), yes.
Does EICE support Windows?
Yes. Open a tunnel to remote port 3389 and point your RDP client at localhost:<local-port>.
Is there a cost difference?
None of the three carries a per-use charge on EC2. EICE adds normal cross-AZ data transfer charges if the endpoint and instance are in different Availability Zones.