.. /AWS SSM Session Manager
Star

Access
Shell Access

AWS Systems Manager Session Manager provides shell access and port forwarding to managed instances over HTTPS, without open inbound ports or SSH keys. With sufficient IAM permissions it allows tunnelling to RDP, SSH or database ports on EC2 and hybrid-activated systems, using traffic to AWS endpoints that organizations commonly allow.

Paths:

Resources:

Detections:

Access

  1. Forwards a local port to a port on the instance through the SSM channel.

    aws ssm start-session --target <INSTANCE_ID> --document-name AWS-StartPortForwardingSession --parameters portNumber=3389,localPortNumber=3389
    Use case
    Reaching RDP, SSH or other services on an instance with no inbound access.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Forwards through the instance to another host reachable from it, using the instance as a pivot.

    aws ssm start-session --target <INSTANCE_ID> --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters host=<INTERNAL_HOST>,portNumber=<PORT>,localPortNumber=<LOCAL_PORT>
    Use case
    Pivoting into private subnets and databases.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Shell Access

  1. Interactive shell on the instance.

    aws ssm start-session --target <INSTANCE_ID>
    Use case
    Shell access that bypasses SSH and network security groups.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS