How to Set Up AWS SSM Connect on EC2: A Complete Guide (No SSH Required)

In modern cloud architectures, security and automation are key. AWS Systems Manager (SSM) Session Manager lets you securely connect to your EC2 instances without SSH, open ports, or bastion hosts. It uses SSM Agent and IAM policies to allow browser- or CLI-based shell access to your instances.

In this guide, we’ll walk through everything you need—from IAM setup to connectivity checks—to get SSM Session Manager working seamlessly.

✨ Why Use AWS SSM Connect?

• No SSH keys to manage

• No port 22 exposure

• Centralized auditing and logging

• Works over private networks via VPC endpoints

• Supports EC2, on-premises servers, and hybrid environments

🧰 Prerequisites

Before you begin, ensure the following:

🛠️ Step-by-Step: Setting up AWS SSM Connect

✅ Step 1: Create an IAM Role for SSM

1. Go to AWS Console → IAM > Roles > Create role

2. Trusted entity: Select EC2

3. Attach permissions policy: Choose AmazonSSMManagedInstanceCore

4. Give it a name, e.g., EC2SSMRole

5. Click Create Role

Now, attach this IAM role to your EC2 instance:

• EC2 Dashboard → Select your instance → Actions > Security > Modify IAM Role

• Choose EC2SSMRole → Apply

✅ Step 2: Install and Start the SSM Agent

Amazon Linux 2 and Ubuntu (20.04+):

Pre-installed and auto-running.

Other OS? Install it manually:

Ubuntu example:

sudo snap install amazon-ssm-agent --classic
sudo systemctl enable amazon-ssm-agent
sudo systemctl start amazon-ssm-agent

Check status:

sudo systemctl status amazon-ssm-agent

✅ Step 3: Ensure Network Connectivity

SSM Agent communicates with the following AWS services:

✅ Step 4: Verify Instance in Systems Manager

Go to:

AWS Console → Systems Manager → Fleet Manager → Managed Instances

✅ Your instance should appear online and managed

If not:

• Verify IAM role is attached

• Check SSM Agent logs: /var/log/amazon/ssm/amazon-ssm-agent.log

• Ensure proper internet/VPC connectivity

✅ Step 5: Connect via Session Manager

Via AWS Console

1. Go to EC2 → Instances → Select your instance

2. Click Connect

3. Select Session Manager tab → Click Connect

🔍 Optional: Enable Logging and Audit Trails

1. Enable CloudWatch Logs for Session Manager

• Go to: Systems Manager → Session Manager → Preferences

• Enable session logging to:

  • CloudWatch Logs group OR

  • S3 bucket

2. Audit with AWS CloudTrail

• Session events are recorded automatically.

• You can filter CloudTrail logs by StartSession, SendCommand, etc.

🎯 Final Thoughts

With AWS SSM Session Manager, you no longer need to expose your EC2 instances via SSH. This dramatically improves your security posture and simplifies access management, especially in production or compliance-heavy environments.

Linkedin