AWS Systems Manager · Short case
Instance access with SSM + SSH
Summary
I configured access to an instance with Session Manager and SSH over SSM. This removes the need to expose port 22 and allows the instance to stay in a private subnet behind the ALB.
- My role
- Access configuration and tag-based control.
- Access
- Session Manager + SSH.
- Scope
- One application.
- Goal
- Private instance behind the ALB.
How it works
The session starts through Systems Manager. Once the tunnel is open, SSH provides access to the operating system. I prepared IAM and tag-based controls to limit access to the correct instance.
This provides technical access without giving the provider a VPN or opening the rest of the network.
What it improves
The instance does not need to expose port 22. The same model allows it to move to a private subnet, leaving only the application traffic behind the ALB.
It is already working for this application, and it is the pattern I want to extend to other instances.