1The End of SSH
In modern AWS architectures, port 22 should be completely closed. By using Session Manager, access is controlled via IAM policies, logged completely in CloudTrail, and sessions can even be recorded to S3 for auditing.
2Step-by-Step Breakdown
What is SSM?. A unified user interface to view operational data and automate tasks across your AWS and on-premises infrastructure.
SSM Agent. To manage an instance, it must have the SSM Agent installed and an IAM role attached granting it permission to talk to the SSM service.
Session Manager. Replaces traditional SSH. Allows you to open a secure, interactive browser-based shell to your EC2 instances WITHOUT opening port 22 or managing SSH keys.
Run Command. Allows you to remotely and securely execute scripts on dozens or hundreds of instances simultaneously without logging into them.
Knowledge Check. Which SSM feature eliminates the need for Bastion Hosts and SSH keys by providing secure browser-based terminal access?
- →Run Command
- →Session Manager
Patch Manager. Automates the process of patching managed instances with both security related and other types of updates across your entire fleet.
Parameter Store. Provides secure, hierarchical storage for configuration data management and secrets (like database strings and API keys).
Parameter Store vs Secrets Manager. Parameter Store is mostly free and great for config data. Secrets Manager costs money but can automatically rotate database passwords on a schedule.
State Manager. A configuration management service that ensures your EC2 instances are kept in a consistent, defined state (e.g., ensuring anti-virus is always running).
Summary. SSM is essential for managing fleets of instances securely and efficiently.
