• The AWS Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html). # Setting up Session Manager Before you use AWS Systems Manager Session Manager to connect to the managed nodes in your account, complete the steps in the following topics. **Topics** + [Step 1: Complete Session Manager prerequisites](session-manager-prerequisites.md) + [Step 2: Verify or add instance permissions for Session Manager](session-manager-getting-started-instance-profile.md) + [Step 3: Control session access to managed nodes](session-manager-getting-started-restrict-access.md) + [Step 4: Configure session preferences](session-manager-getting-started-configure-preferences.md) + [Step 5: (Optional) Restrict access to commands in a session](session-manager-restrict-command-access.md) + [Step 6: (Optional) Use AWS PrivateLink to set up a VPC endpoint for Session Manager](session-manager-getting-started-privatelink.md) + [Step 7: (Optional) Turn on or turn off ssm-user account administrative permissions](session-manager-getting-started-ssm-user-permissions.md) + [Step 8: (Optional) Allow and control permissions for SSH connections through Session Manager](session-manager-getting-started-enable-ssh-connections.md) # Step 1: Complete Session Manager prerequisites Before using Session Manager, make sure your environment meets the following requirements. **Session Manager prerequisites** | Requirement | Description | | --- | --- | | Supported operating systems | Session Manager supports connecting to Amazon Elastic Compute Cloud (Amazon EC2) instances, in addition to non-EC2 machines in your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment that use the *advanced-instances* tier. Session Manager supports the following operating system versions: Session Manager supports EC2 instances, edge devices, and on-premises servers and virtual machines (VMs) in your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment that use the *advanced-instances* tier. For more information about advanced instances, see [Configuring instance tiers](fleet-manager-configure-instance-tiers.md). **Linux and **macOS**** Session Manager supports all the versions of Linux and macOS that are supported by AWS Systems Manager. For information, see [Supported operating systems and machine types](operating-systems-and-machine-types.md). ** Windows ** Session Manager supports Windows Server 2012 and later versions. Microsoft Windows Server 2016 Nano isn't supported. | | SSM Agent | At minimum, AWS Systems Manager SSM Agent version 2.3.68.0 or later must be installed on the managed nodes you want to connect to through sessions. To use the option to encrypt session data using a key created in AWS Key Management Service (AWS KMS), version 2.3.539.0 or later of SSM Agent must be installed on the managed node. To use shell profiles in a session, SSM Agent version 3.0.161.0 or later must be installed on the managed node. To start a Session Manager port forwarding or SSH session, SSM Agent version 3.0.222.0 or later must be installed on the managed node. To stream session data using Amazon CloudWatch Logs, SSM Agent version 3.0.284.0 or later must be installed on the managed node. For information about how to determine the version number running on an instance, see [Checking the SSM Agent version number](ssm-agent-get-version.md). For information about manually installing or automatically updating SSM Agent, see [Working with SSM Agent](ssm-agent.md). About the ssm-user account Starting with version 2.3.50.0 of SSM Agent, the agent creates a user account on the managed node, with root or administrator permissions, called `ssm-user`. (On versions before 2.3.612.0, the account is created when SSM Agent starts or restarts. On version 2.3.612.0 and later, `ssm-user` is created the first time a session starts on the managed node.) Sessions are launched using the administrative credentials of this user account. For information about restricting administrative control for this account, see [Turn off or turn on ssm-user account administrative permissions](session-manager-getting-started-ssm-user-permissions.md). ssm-user on Windows Server domain controllers Beginning with SSM Agent version 2.3.612.0, the `ssm-user` account isn't created automatically on managed nodes that are used as Windows Server domain controllers. To use Session Manager on a Windows Server machine being used as a domain controller, you must create the `ssm-user` account manually if it isn't already present, and assign Domain Administrator permissions to the user. On Windows Server, SSM Agent sets a new password for the `ssm-user` account each time a session starts, so you don't need to specify a password when you create the account. | | Connectivity to endpoints | The managed nodes you connect to must also allow HTTPS (port 443) outbound traffic to the following endpoints: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html) For more information, see the following topics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html) Alternatively, you can connect to the required endpoints by using interface endpoints. For more information, see [Step 6: (Optional) Use AWS PrivateLink to set up a VPC endpoint for Session Manager](session-manager-getting-started-privatelink.md). | | AWS CLI | (Optional) If you use the AWS Command Line Interface (AWS CLI) to start your sessions (instead of using the AWS Systems Manager console or Amazon EC2 console), version 1.16.12 or later of the CLI must be installed on your local machine. You can call `aws --version` to check the version. If you need to install or upgrade the CLI, see [Installing the AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/installing.html) in the AWS Command Line Interface User Guide. An updated version of SSM Agent is released whenever new tools are added to Systems Manager or updates are made to existing tools. Failing to use the latest version of the agent can prevent your managed node from using various Systems Manager tools and features. For that reason, we recommend that you automate the process of keeping SSM Agent up to date on your machines. For information, see [Automating updates to SSM Agent](ssm-agent-automatic-updates.md). Subscribe to the [SSM Agent Release Notes](https://github.com/aws/amazon-ssm-agent/blob/mainline/RELEASENOTES.md) page on GitHub to get notifications about SSM Agent updates. In addition, to use the CLI to manage your nodes with Session Manager, you must first install the Session Manager plugin on your local machine. For information, see [Install the Session Manager plugin for the AWS CLI](session-manager-working-with-install-plugin.md). | | Turn on advanced-instances tier ([hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environments) | To connect to non-EC2 machines using Session Manager, you must turn on the advanced-instances tier in the AWS account and AWS Region where you create hybrid activations to register non-EC2 machines as managed nodes. There is a charge to use the advanced-instances tier. For more information about the advanced-instance tier, see [Configuring instance tiers](fleet-manager-configure-instance-tiers.md). | | Verify IAM service role permissions ([hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environments) | Hybrid-activated nodes use the AWS Identity and Access Management (IAM) service role specified in the hybrid activation to communicate with Systems Manager API operations. This service role must contain the permissions required to connect to your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) machines using Session Manager. If your service role contains the AWS managed policy `AmazonSSMManagedInstanceCore` , the required permissions for Session Manager are already provided. If you find that the service role does not contain the required permissions, you must deregister the managed instance and register it with a new hybrid activation that uses an IAM service role with the required permissions. For more information about deregistering managed instances, see [Deregistering managed nodes in a hybrid and multicloud environment](fleet-manager-deregister-hybrid-nodes.md). For more information about creating IAM policies with Session Manager permissions, see [Step 2: Verify or add instance permissions for Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-instance-profile.html). | # Step 2: Verify or add instance permissions for Session Manager By default, AWS Systems Manager doesn't have permission to perform actions on your instances. You can provide instance permissions at the account level using an AWS Identity and Access Management (IAM) role, or at the instance level using an instance profile. If your use case allows, we recommend granting access at the account level using the Default Host Management Configuration. If you've already set up the Default Host Management Configuration for your account using the `AmazonSSMManagedEC2InstanceDefaultPolicy` policy, you can proceed to the next step. For more information about the Default Host Management Configuration, see [Managing EC2 instances automatically with Default Host Management Configuration](fleet-manager-default-host-management-configuration.md). Alternatively, you can use instance profiles to provide the required permissions to your instances. An instance profile passes an IAM role to an Amazon EC2 instance. You can attach an IAM instance profile to an Amazon EC2 instance as you launch it or to a previously launched instance. For more information, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-usingrole-instanceprofile.html). For on-premises servers or virtual machines (VMs), permissions are provided by the IAM service role associated with the hybrid activation used to register your on-premises servers and VMs with Systems Manager. On-premises servers and VMs do not use instance profiles. If you already use other Systems Manager tools, such as Run Command or Parameter Store, an instance profile with the required basic permissions for Session Manager might already be attached to your Amazon EC2 instances. If an instance profile that contains the AWS managed policy `AmazonSSMManagedInstanceCore` is already attached to your instances, the required permissions for Session Manager are already provided. This is also true if the IAM service role used in your hybrid activation contains the `AmazonSSMManagedInstanceCore` managed policy. However, in some cases, you might need to modify the permissions attached to your instance profile. For example, you want to provide a narrower set of instance permissions, you have created a custom policy for your instance profile, or you want to use Amazon Simple Storage Service (Amazon S3) encryption or AWS Key Management Service (AWS KMS) encryption options for securing session data. For these cases, do one of the following to allow Session Manager actions to be performed on your instances: + **Embed permissions for Session Manager actions in a custom IAM role** To add permissions for Session Manager actions to an existing IAM role that doesn't rely on the AWS-provided default policy `AmazonSSMManagedInstanceCore`, follow the steps in [Add Session Manager permissions to an existing IAM role](getting-started-add-permissions-to-existing-profile.md). + **Create a custom IAM role with Session Manager permissions only** To create an IAM role that contains permissions only for Session Manager actions, follow the steps in [Create a custom IAM role for Session Manager](getting-started-create-iam-instance-profile.md). + **Create and use a new IAM role with permissions for all Systems Manager actions** To create an IAM role for Systems Manager managed instances that uses a default policy supplied by AWS to grant all Systems Manager permissions, follow the steps in [Configure instance permissions required for Systems Manager](setup-instance-permissions.md). **Topics** + [Add Session Manager permissions to an existing IAM role](getting-started-add-permissions-to-existing-profile.md) + [Create a custom IAM role for Session Manager](getting-started-create-iam-instance-profile.md) # Add Session Manager permissions to an existing IAM role Use the following procedure to add Session Manager permissions to an existing AWS Identity and Access Management (IAM) role. By adding permissions to an existing role, you can enhance the security of your computing environment without having to use the AWS `AmazonSSMManagedInstanceCore` policy for instance permissions. **Note** Note the following information: This procedure assumes that your existing role already includes other Systems Manager `ssm` permissions for actions you want to allow access to. This policy alone isn't enough to use Session Manager. The following policy example includes an `s3:GetEncryptionConfiguration` action. This action is required if you chose the **Enforce S3 log encryption** option in Session Manager logging preferences. If the `ssmmessages:OpenControlChannel` permission is removed from policies attached to your IAM instance profile or IAM service role,SSM Agent on the managed node loses connectivity to the Systems Manager service in the cloud. However, it can take up to 1 hour for a connection to be terminated after the permission is removed. This is the same behavior as when the IAM instance role or IAM service role is deleted. **To add Session Manager permissions to an existing role (console)** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Roles**. 1. Select the name of the role that you are adding the permissions to. 1. Choose the **Permissions** tab. 1. Choose **Add permissions**, and then select **Create inline policy**. 1. Choose the **JSON** tab. 1. Replace the default policy content with the following content. Replace *key-name* with the Amazon Resource Name (ARN) of the AWS Key Management Service key (AWS KMS key) that you want to use. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-name" } ] } ``` ------ For information about using a KMS key to encrypt session data, see [Turn on KMS key encryption of session data (console)](session-preferences-enable-encryption.md). If you won't use AWS KMS encryption for your session data, you can remove the following content from the policy. ``` , { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "key-name" } ``` 1. Choose **Next: Tags**. 1. (Optional) Add tags by choosing **Add tag**, and entering the preferred tags for the policy. 1. Choose **Next: Review**. 1. On the **Review policy** page, for **Name**, enter a name for the inline policy, such as **SessionManagerPermissions**. 1. (Optional) For **Description**, enter a description for the policy. Choose **Create policy**. For information about the `ssmmessages` actions, see [Reference: ec2messages, ssmmessages, and other API operations](systems-manager-setting-up-messageAPIs.md). # Create a custom IAM role for Session Manager You can create an AWS Identity and Access Management (IAM) role that grants Session Manager the permission to perform actions on your Amazon EC2 managed instances. You can also include a policy to grant the permissions needed for session logs to be sent to Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. After you create the IAM role, for information about how to attach the role to an instance, see [Attach or Replace an Instance Profile](https://aws.amazon.com/premiumsupport/knowledge-center/attach-replace-ec2-instance-profile/) at the AWS re:Post website. For more information about IAM instance profiles and roles, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the *IAM User Guide* and [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) in the *Amazon Elastic Compute Cloud User Guide for Linux Instances*. For more information about creating an IAM service role for on-premises machines, see [Create the IAM service role required for Systems Manager in hybrid and multicloud environments](https://docs.aws.amazon.com/systems-manager/latest/userguide/hybrid-multicloud-service-role.html). **Topics** + [Creating an IAM role with minimal Session Manager permissions (console)](#create-iam-instance-profile-ssn-only) + [Creating an IAM role with permissions for Session Manager and Amazon S3 and CloudWatch Logs (console)](#create-iam-instance-profile-ssn-logging) ## Creating an IAM role with minimal Session Manager permissions (console) Use the following procedure to create a custom IAM role with a policy that provides permissions for only Session Manager actions on your instances. **To create an instance profile with minimal Session Manager permissions (console)** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Policies**, and then choose **Create policy**. (If a **Get Started** button is displayed, choose it, and then choose **Create Policy**.) 1. Choose the **JSON** tab. 1. Replace the default content with the following policy. To encrypt session data using AWS Key Management Service (AWS KMS), replace *key-name* with the Amazon Resource Name (ARN) of the AWS KMS key that you want to use. **Note** If the `ssmmessages:OpenControlChannel` permission is removed from policies attached to your IAM instance profile or IAM service role,SSM Agent on the managed node loses connectivity to the Systems Manager service in the cloud. However, it can take up to 1 hour for a connection to be terminated after the permission is removed. This is the same behavior as when the IAM instance role or IAM service role is deleted. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:UpdateInstanceInformation", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-name" } ] } ``` ------ For information about using a KMS key to encrypt session data, see [Turn on KMS key encryption of session data (console)](session-preferences-enable-encryption.md). If you won't use AWS KMS encryption for your session data, you can remove the following content from the policy. ``` , { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "key-name" } ``` 1. Choose **Next: Tags**. 1. (Optional) Add tags by choosing **Add tag**, and entering the preferred tags for the policy. 1. Choose **Next: Review**. 1. On the **Review policy** page, for **Name**, enter a name for the inline policy, such as **SessionManagerPermissions**. 1. (Optional) For **Description**, enter a description for the policy. 1. Choose **Create policy**. 1. In the navigation pane, choose **Roles**, and then choose **Create role**. 1. On the **Create role** page, choose **AWS service**, and for **Use case**, choose **EC2**. 1. Choose **Next**. 1. On the **Add permissions** page, select the check box to the left of name of the policy you just created, such as **SessionManagerPermissions**. 1. Choose **Next**. 1. On the **Name, review, and create** page, for **Role name**, enter a name for the IAM role, such as **MySessionManagerRole**. 1. (Optional) For **Role description**, enter a description for the instance profile. 1. (Optional) Add tags by choosing **Add tag**, and entering the preferred tags for the role. Choose **Create role**. For information about `ssmmessages` actions, see [Reference: ec2messages, ssmmessages, and other API operations](systems-manager-setting-up-messageAPIs.md). ## Creating an IAM role with permissions for Session Manager and Amazon S3 and CloudWatch Logs (console) Use the following procedure to create a custom IAM role with a policy that provides permissions for Session Manager actions on your instances. The policy also provides the permissions needed for session logs to be stored in Amazon Simple Storage Service (Amazon S3) buckets and Amazon CloudWatch Logs log groups. **Important** To output session logs to an Amazon S3 bucket owned by a different AWS account, you must add the `s3:PutObjectAcl` permission to the IAM role policy. Additionally, you must ensure that the bucket policy grants cross-account access to the IAM role used by the owning account to grant Systems Manager permissions for managed instances. If the bucket uses Key Management Service (KMS) encryption, then the bucket's KMS policy must also grant this cross-account access. For more information about configuring cross-account bucket permissions in Amazon S3, see [Granting cross-account bucket permissions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example2.html) in the *Amazon Simple Storage Service User Guide*. If the cross-account permissions aren't added, the account that owns the Amazon S3 bucket can't access the session output logs. For information about specifying preferences for storing session logs, see [Enabling and disabling session logging](session-manager-logging.md). **To create an IAM role with permissions for Session Manager and Amazon S3 and CloudWatch Logs (console)** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Policies**, and then choose **Create policy**. (If a **Get Started** button is displayed, choose it, and then choose **Create Policy**.) 1. Choose the **JSON** tab. 1. Replace the default content with the following policy. Replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:UpdateInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/s3-prefix/*" }, { "Effect": "Allow", "Action": [ "s3:GetEncryptionConfiguration" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-name" }, { "Effect": "Allow", "Action": "kms:GenerateDataKey", "Resource": "*" } ] } ``` ------ 1. Choose **Next: Tags**. 1. (Optional) Add tags by choosing **Add tag**, and entering the preferred tags for the policy. 1. Choose **Next: Review**. 1. On the **Review policy** page, for **Name**, enter a name for the inline policy, such as **SessionManagerPermissions**. 1. (Optional) For **Description**, enter a description for the policy. 1. Choose **Create policy**. 1. In the navigation pane, choose **Roles**, and then choose **Create role**. 1. On the **Create role** page, choose **AWS service**, and for **Use case**, choose **EC2**. 1. Choose **Next**. 1. On the **Add permissions** page, select the check box to the left of name of the policy you just created, such as **SessionManagerPermissions**. 1. Choose **Next**. 1. On the **Name, review, and create** page, for **Role name**, enter a name for the IAM role, such as **MySessionManagerRole**. 1. (Optional) For **Role description**, enter a description for the role. 1. (Optional) Add tags by choosing **Add tag**, and entering the preferred tags for the role. 1. Choose **Create role**. # Step 3: Control session access to managed nodes You grant or revoke Session Manager access to managed nodes by using AWS Identity and Access Management (IAM) policies. You can create a policy and attach it to an IAM user or group that specifies which managed nodes the user or group can connect to. You can also specify the Session Manager API operations the user or groups can perform on those managed nodes. To help you get started with IAM permission policies for Session Manager, we've created sample policies for an end user and an administrator user. You can use these policies with only minor changes. Or, use them as a guide to create custom IAM policies. For more information, see [Sample IAM policies for Session Manager](getting-started-restrict-access-quickstart.md). For information about how to create IAM policies and attach them to users or groups, see [Creating IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) and [Adding and Removing IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the *IAM User Guide*. **About session ID ARN formats** When you create an IAM policy for Session Manager access, you specify a session ID as part of the Amazon Resource Name (ARN). The session ID includes the user name as a variable. To help illustrate this, here's the format of a Session Manager ARN and an example: ``` arn:aws:ssm:region-id:account-id:session/session-id ``` For example: ``` arn:aws:ssm:us-east-2:123456789012:session/JohnDoe-1a2b3c4d5eEXAMPLE ``` For more information about using variables in IAM policies, see [IAM Policy Elements: Variables](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html). **Topics** + [Start a default shell session by specifying the default session document in IAM policies](getting-started-default-session-document.md) + [Start a session with a document by specifying the session documents in IAM policies](getting-started-specify-session-document.md) + [Sample IAM policies for Session Manager](getting-started-restrict-access-quickstart.md) + [Additional sample IAM policies for Session Manager](getting-started-restrict-access-examples.md) # Start a default shell session by specifying the default session document in IAM policies When you configure Session Manager for your AWS account or when you change session preferences in the Systems Manager console, the system creates an SSM session document called `SSM-SessionManagerRunShell`. This is the default session document. Session Manager uses this document to store your session preferences, which include information like the following: + A location where you want to save session data, such an Amazon Simple Storage Service (Amazon S3) bucket or a Amazon CloudWatch Logs log group. + An AWS Key Management Service (AWS KMS) key ID for encrypting session data. + Whether Run As support is allowed for your sessions. Here is an example of the information contained in the `SSM-SessionManagerRunShell` session preferences document. ``` { "schemaVersion": "1.0", "description": "Document to hold regional settings for Session Manager", "sessionType": "Standard_Stream", "inputs": { "s3BucketName": "amzn-s3-demo-bucket", "s3KeyPrefix": "MyS3Prefix", "s3EncryptionEnabled": true, "cloudWatchLogGroupName": "MyCWLogGroup", "cloudWatchEncryptionEnabled": false, "kmsKeyId": "1a2b3c4d", "runAsEnabled": true, "runAsDefaultUser": "RunAsUser" } } ``` By default, Session Manager uses the default session document when a user starts a session from the AWS Management Console. This applies to either Fleet Manager or Session Manager in the Systems Manager console, or EC2 Connect in the Amazon EC2 console. Session Manager also uses the default session document when a user starts a session by using an AWS CLI command like the following example: ``` aws ssm start-session \ --target i-02573cafcfEXAMPLE ``` To start a default shell session, you must specify the default session document in the IAM policy, as shown in the following example. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "EnableSSMSession", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/instance-id", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "*" ] } ] } ``` ------ # Start a session with a document by specifying the session documents in IAM policies If you use the [start-session](https://docs.aws.amazon.com/cli/latest/reference/ssm/start-session.html) AWS CLI command using the default session document, you can omit the document name. The system automatically calls the `SSM-SessionManagerRunShell` session document. In all other cases, you must specify a value for the `document-name` parameter. When a user specifies the name of a session document in a command, the systems checks their IAM policy to verify they have permission to access the document. If they don't have permission, the connection request fails. The following examples includes the `document-name` parameter with the `AWS-StartPortForwardingSession` session document. ``` aws ssm start-session \ --target i-02573cafcfEXAMPLE \ --document-name AWS-StartPortForwardingSession \ --parameters '{"portNumber":["80"], "localPortNumber":["56789"]}' ``` For an example of how to specify a Session Manager session document in an IAM policy, see [Quickstart end user policies for Session Manager](getting-started-restrict-access-quickstart.md#restrict-access-quickstart-end-user). **Note** To start a session using SSH, you must complete configuration steps on the target managed node *and* the user's local machine. For information, see [(Optional) Allow and control permissions for SSH connections through Session Manager](session-manager-getting-started-enable-ssh-connections.md). # Sample IAM policies for Session Manager Use the samples in this section to help you create AWS Identity and Access Management (IAM) policies that provide the most commonly needed permissions for Session Manager access. **Note** You can also use an AWS KMS key policy to control which IAM entities (users or roles) and AWS accounts are given access to your KMS key. For information, see [Overview of Managing Access to Your AWS KMS Resources](https://docs.aws.amazon.com/kms/latest/developerguide/control-access-overview.html) and [Using Key Policies in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) in the *AWS Key Management Service Developer Guide*. **Topics** + [Quickstart end user policies for Session Manager](#restrict-access-quickstart-end-user) + [Quickstart administrator policy for Session Manager](#restrict-access-quickstart-admin) ## Quickstart end user policies for Session Manager Use the following examples to create IAM end user policies for Session Manager. You can create a policy that allows users to start sessions from only the Session Manager console and AWS Command Line Interface (AWS CLI), from only the Amazon Elastic Compute Cloud (Amazon EC2) console, or from all three. These policies provide end users the ability to start a session to a particular managed node and the ability to end only their own sessions. Refer to [Additional sample IAM policies for Session Manager](getting-started-restrict-access-examples.md) for examples of customizations you might want to make to the policy. In the following sample policies, replace each *example resource placeholder* with your own information. Choose from the following tabs to view the sample policy for the range of session access you want to provide. ------ #### [ Session Manager and Fleet Manager ] Use this sample policy to give users the ability to start and resume sessions from only the Session Manager and Fleet Manager consoles. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-02573cafcfEXAMPLE", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus", "ssm:DescribeInstanceProperties", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-name" } ] } ``` ------ ------ #### [ Amazon EC2 ] Use this sample policy to give users the ability to start and resume sessions from only the Amazon EC2 console. This policy doesn't provide all the permissions needed to start sessions from the Session Manager console and the AWS CLI. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-02573cafcfEXAMPLE", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:username}-*" ] } ] } ``` ------ ------ #### [ AWS CLI ] Use this sample policy to give users the ability to start and resume sessions from the AWS CLI. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-02573cafcfEXAMPLE", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-name" } ] } ``` ------ ------ **Note** `SSM-SessionManagerRunShell` is the default name of the SSM document that Session Manager creates to store your session configuration preferences. You can create a custom Session document and specify it in this policy instead. You can also specify the AWS-provided document `AWS-StartSSHSession` for users who are starting sessions using SSH. For information about configuration steps needed to support sessions using SSH, see [(Optional) Allow and control permissions for SSH connections through Session Manager](session-manager-getting-started-enable-ssh-connections.md). The `kms:GenerateDataKey` permission enables the creation of a data encryption key that will be used to encrypt session data. If you will use AWS Key Management Service (AWS KMS) encryption for your session data, replace *key-name* with the Amazon Resource Name (ARN) of the KMS key you want to use, in the format `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-12345EXAMPLE`. If you won't use KMS key encryption for your session data, remove the following content from the policy. ``` { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "key-name" } ``` For information about using AWS KMS for encrypting session data, see [Turn on KMS key encryption of session data (console)](session-preferences-enable-encryption.md). The permission for [https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) is needed for cases where a user attempts to start a session from the Amazon EC2 console, but the SSM Agent must be updated to the minimum required version for Session Manager first. Run Command is used to send a command to the instance to update the agent. ## Quickstart administrator policy for Session Manager Use the following examples to create IAM administrator policies for Session Manager. These policies provide administrators the ability to start a session to managed nodes that are tagged with `Key=Finance,Value=WebServers`, permission to create, update, and delete preferences, and permission to end only their own sessions. Refer to [Additional sample IAM policies for Session Manager](getting-started-restrict-access-examples.md) for examples of customizations you might want to make to the policy. You can create a policy that allows administrators to perform these tasks from only the Session Manager console and AWS CLI, from only the Amazon EC2 console, or from all three. In the following sample policies, replace each *example resource placeholder* with your own information. Choose from the following tabs to view the sample policy for the access scenario you want to support. ------ #### [ Session Manager and CLI ] Use this sample policy to give administrators the ability to perform session-related tasks from only the Session Manager console and the AWS CLI. This policy doesn't provide all the permissions needed to perform session-related tasks from the Amazon EC2 console. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:111122223333:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/Finance": [ "WebServers" ] } } }, { "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus", "ssm:DescribeInstanceProperties", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:GetDocument", "ssm:StartSession" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" }, { "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] } ] } ``` ------ ------ #### [ Amazon EC2 ] Use this sample policy to give administrators the ability to perform session-related tasks from only the Amazon EC2 console. This policy doesn't provide all the permissions needed to perform session-related tasks from the Session Manager console and the AWS CLI. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/tag-key": [ "tag-value" ] } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] } ] } ``` ------ ------ #### [ Session Manager, CLI, and Amazon EC2 ] Use this sample policy to give administrators the ability to perform session-related tasks from the Session Manager console, the AWS CLI, and the Amazon EC2 console. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/tag-key": [ "tag-value" ] } } }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation", "ssm:DescribeInstanceProperties", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:GetDocument", "ssm:StartSession" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] } ] } ``` ------ ------ **Note** The permission for [https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) is needed for cases where a user attempts to start a session from the Amazon EC2 console, but a command must be sent to update SSM Agent first. # Additional sample IAM policies for Session Manager Refer to the following example policies to help you create a custom AWS Identity and Access Management (IAM) policy for any Session Manager user access scenarios you want to support. **Topics** + [Example 1: Grant access to documents in the console](#grant-access-documents-console-example) + [Example 2: Restrict access to specific managed nodes](#restrict-access-example-instances) + [Example 3: Restrict access based on tags](#restrict-access-example-instance-tags) + [Example 4: Allow a user to end only sessions they started](#restrict-access-example-user-sessions) + [Example 5: Allow full (administrative) access to all sessions](#restrict-access-example-full-access) ## Example 1: Grant access to documents in the console You can allow users to specify a custom document when they launch a session using the Session Manager console. The following example IAM policy grants permission to access documents with names that begin with **SessionDocument-** in the specified AWS Region and AWS account. To use this policy, replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:ListDocuments" ], "Resource": [ "arn:aws:ssm:us-east-1:111122223333:document/SessionDocument-*" ] } ] } ``` ------ **Note** The Session Manager console only supports Session documents that have a `sessionType` of `Standard_Stream` which are used to define session preferences. For more information, see [Session document schema](session-manager-schema.md). ## Example 2: Restrict access to specific managed nodes You can create an IAM policy that defines which managed nodes that a user is allowed to connect to using Session Manager. For example, the following policy grants a user the permission to start, end, and resume their sessions on three specific nodes. The policy restricts the user from connecting to nodes other than those specified. **Note** For federated users, see [Example 4: Allow a user to end only sessions they started](#restrict-access-example-user-sessions). ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-1234567890EXAMPLE", "arn:aws:ec2:us-east-1:111122223333:instance/i-abcdefghijEXAMPLE", "arn:aws:ec2:us-east-1:111122223333:instance/i-0e9d8c7b6aEXAMPLE", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] } ] } ``` ------ ## Example 3: Restrict access based on tags You can restrict access to managed nodes based on specific tags. In the following example, the user is allowed to start and resume sessions (`Effect: Allow, Action: ssm:StartSession, ssm:ResumeSession`) on any managed node (`Resource: arn:aws:ec2:region:987654321098:instance/*`) with the condition that the node is a Finance WebServer (`ssm:resourceTag/Finance: WebServer`). If the user sends a command to a managed node that isn't tagged or that has any tag other than `Finance: WebServer`, the command result will include `AccessDenied`. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/Finance": [ "WebServers" ] } } }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] } ] } ``` ------ You can create IAM policies that allow a user to start sessions to managed nodes that are tagged with multiple tags. The following policy allows the user to start sessions to managed nodes that have both the specified tags applied to them. If a user sends a command to a managed node that isn't tagged with both of these tags, the command result will include `AccessDenied`. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "ssm:StartSession" ], "Resource":"*", "Condition":{ "StringLike":{ "ssm:resourceTag/tag-key1":[ "tag-value1" ], "ssm:resourceTag/tag-key2":[ "tag-value2" ] } } }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] } ] } ``` ------ For more information about creating IAM policies, see [Managed Policies and Inline Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) in the *IAM User Guide*. For more information about tagging managed nodes, see [Tagging your Amazon EC2 resources](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html) in the *Amazon EC2 User Guide* (content applies to Windows and Linux managed nodes). For more information about increasing your security posture against unauthorized root-level commands on your managed nodes, see [Restricting access to root-level commands through SSM Agent](ssm-agent-restrict-root-level-commands.md) ## Example 4: Allow a user to end only sessions they started Session Manager provides two methods to control which sessions a federated user in your AWS account is allowed to end. + Use the variable `{aws:userid}` in an AWS Identity and Access Management (IAM) permissions policy. Federated users can end only sessions they started. For unfederated users, use Method 1. For federated users, use Method 2. + Use tags supplied by AWS tags in an IAM permissions policy. In the policy, you include a condition that allows users to end only sessions that are tagged with specific tags that have been provided by AWS. This method works for all accounts, including those that use federated IDs to grant access to AWS. ### Method 1: Grant TerminateSession privileges using the variable `{aws:username}` The following IAM policy allows a user to view the IDs of all sessions in your account. However, users can interact with managed nodes only through sessions they started. A user who is assigned the following policy can't connect to or end other users' sessions. The policy uses the variable `{aws:username}` to achieve this. **Note** This method doesn't work for accounts that grant access to AWS using federated IDs. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Action": [ "ssm:DescribeSessions" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Action": [ "ssm:TerminateSession" ], "Effect": "Allow", "Resource": [ "arn:aws:ssm:*:*:session/${aws:username}-*" ] } ] } ``` ------ ### Method 2: Grant TerminateSession privileges using tags supplied by AWS You can control which sessions that a user can end by including conditional tag key variables in an IAM policy. The condition specifies that the user can only end sessions that are tagged with one or both of these specific tag key variables and a specified value. When a user in your AWS account starts a session, Session Manager applies two resource tags to the session. The first resource tag is `aws:ssmmessages:target-id`, with which you specify the ID of the target the user is allowed to end. The other resource tag is `aws:ssmmessages:session-id`, with a value in the format of `role-id:caller-specified-role-name`. **Note** Session Manager doesn’t support custom tags for this IAM access control policy. You must use the resource tags supplied by AWS, described below. ** `aws:ssmmessages:target-id` ** With this tag key, you include the managed node ID as the value in policy. In the following policy block, the condition statement allows a user to end only the node i-02573cafcfEXAMPLE. **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:TerminateSession" ], "Resource": "*", "Condition": { "StringLike": { "ssm:resourceTag/aws:ssmmessages:target-id": [ "i-02573cafcfEXAMPLE" ] } } } ] } ``` If the user tries to end a session for which they haven’t been granted this `TerminateSession` permission, they receive an `AccessDeniedException` error. ** `aws:ssmmessages:session-id` ** This tag key includes a variable for the session ID as the value in the request to start a session. The following example demonstrates a policy for cases where the caller type is `User`. The value you supply for `aws:ssmmessages:session-id` is the ID of the user. In this example, `AIDIODR4TAW7CSEXAMPLE` represents the ID of a user in your AWS account. To retrieve the ID for a user in your AWS account, use the IAM command, `get-user`. For information, see [get-user](https://docs.aws.amazon.com/IAM/latest/UserGuide/get-user.html) in the AWS Identity and Access Management section of the *IAM User Guide*. **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:TerminateSession" ], "Resource": "*", "Condition": { "StringLike": { "ssm:resourceTag/aws:ssmmessages:session-id": [ "AIDIODR4TAW7CSEXAMPLE" ] } } } ] } ``` The following example demonstrates a policy for cases where the caller type is `AssumedRole`. You can use the `{aws:userid}` variable for the value you supply for `aws:ssmmessages:session-id`. Alternatively, you can hardcode a role ID for the value you supply for `aws:ssmmessages:session-id`. If you hardcode a role ID, you must provide the value in the format `role-id:caller-specified-role-name`. For example, `AIDIODR4TAW7CSEXAMPLE:MyRole`. In order for system tags to be applied, the role ID you supply can contain the following characters only: Unicode letters, 0-9, space, `_`, `.`, `:`, `/`, `=`, `+`, `-`, `@`, and `\`. To retrieve the role ID for a role in your AWS account, use the `get-caller-identity` command. For information, see [get-caller-identity](https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html) in the AWS CLI Command Reference. **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:TerminateSession" ], "Resource": "*", "Condition": { "StringLike": { "ssm:resourceTag/aws:ssmmessages:session-id": [ "${aws:userid}*" ] } } } ] } ``` If a user tries to end a session for which they haven’t been granted this `TerminateSession` permission, they receive an `AccessDeniedException` error. **`aws:ssmmessages:target-id`** and **`aws:ssmmessages:session-id`** You can also create IAM policies that allow a user to end sessions that are tagged with both system tags, as shown in this example. **** ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "ssm:TerminateSession" ], "Resource":"*", "Condition":{ "StringLike":{ "ssm:resourceTag/aws:ssmmessages:target-id":[ "i-02573cafcfEXAMPLE" ], "ssm:resourceTag/aws:ssmmessages:session-id":[ "${aws:userid}*" ] } } } ] } ``` ## Example 5: Allow full (administrative) access to all sessions The following IAM policy allows a user to fully interact with all managed nodes and all sessions created by all users for all nodes. It should be granted only to an Administrator who needs full control over your organization's Session Manager activities. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Action": [ "ssm:StartSession", "ssm:TerminateSession", "ssm:ResumeSession", "ssm:DescribeSessions", "ssm:GetConnectionStatus" ], "Effect": "Allow", "Resource": [ "*" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] } ] } ``` ------ # Step 4: Configure session preferences Users that have been granted administrative permissions in their AWS Identity and Access Management (IAM) policy can configure session preferences, including the following: + Turn on Run As support for Linux managed nodes. This makes it possible to start sessions using the credentials of a specified operating system user instead of the credentials of a system-generated `ssm-user` account that AWS Systems Manager Session Manager can create on a managed node. + Configure Session Manager to use AWS KMS key encryption to provide additional protection to the data transmitted between client machines and managed nodes. + Configure Session Manager to create and send session history logs to an Amazon Simple Storage Service (Amazon S3) bucket or an Amazon CloudWatch Logs log group. The stored log data can then be used to report on the session connections made to your managed nodes and the commands run on them during the sessions. + Configure session timeouts. You can use this setting to specify when to end a session after a period of inactivity. + Configure Session Manager to use configurable shell profiles. These customizable profiles allow you to define preferences within sessions such as shell preferences, environment variables, working directories, and running multiple commands when a session is started. For more information about the permissions needed to configue Session Manager preferences, see [Grant or deny a user permissions to update Session Manager preferences](preference-setting-permissions.md). **Topics** + [Grant or deny a user permissions to update Session Manager preferences](preference-setting-permissions.md) + [Specify an idle session timeout value](session-preferences-timeout.md) + [Specify maximum session duration](session-preferences-max-timeout.md) + [Allow configurable shell profiles](session-preferences-shell-config.md) + [Turn on Run As support for Linux and macOS managed nodes](session-preferences-run-as.md) + [Turn on KMS key encryption of session data (console)](session-preferences-enable-encryption.md) + [Create a Session Manager preferences document (command line)](getting-started-create-preferences-cli.md) + [Update Session Manager preferences (command line)](getting-started-configure-preferences-cli.md) For information about using the Systems Manager console to configure options for logging session data, see the following topics: + [Logging session data using Amazon S3 (console)](session-manager-logging-s3.md) + [Streaming session data using Amazon CloudWatch Logs (console)](session-manager-logging-cwl-streaming.md) + [Logging session data using Amazon CloudWatch Logs (console)](session-manager-logging-cloudwatch-logs.md) # Grant or deny a user permissions to update Session Manager preferences Account preferences are stored as AWS Systems Manager (SSM) documents for each AWS Region. Before a user can update account preferences for sessions in your account, they must be granted the necessary permissions to access the type of SSM document where these preferences are stored. These permissions are granted through an AWS Identity and Access Management (IAM) policy. **Administrator policy to allow preferences to be created and updated** An administrator can have the following policy to create and update preferences at any time. The following policy allows permission to access and update the `SSM-SessionManagerRunShell` document in the us-east-2 account 123456789012. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Action": [ "ssm:CreateDocument", "ssm:GetDocument", "ssm:UpdateDocument", "ssm:DeleteDocument" ], "Effect": "Allow", "Resource": [ "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] } ] } ``` ------ **User policy to prevent preferences from being updated** Use the following policy to prevent end users in your account from updating or overriding any Session Manager preferences. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Action": [ "ssm:CreateDocument", "ssm:GetDocument", "ssm:UpdateDocument", "ssm:DeleteDocument" ], "Effect": "Deny", "Resource": [ "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] } ] } ``` ------ # Specify an idle session timeout value Session Manager, a tool in AWS Systems Manager, allows you to specify the amount of time to allow a user to be inactive before the system ends a session. By default, sessions time out after 20 minutes of inactivity. You can modify this setting to specify that a session times out between 1 and 60 minutes of inactivity. Some professional computing security agencies recommend setting idle session timeouts to a maximum of 15 minutes. The idle session timeout timer resets when Session Manager receives client-side inputs. These inputs include, but are not limited to: + Keyboard input in the terminal + Terminal or browser window resize events + Session reconnection (ResumeSession), which can occur due to network interruptions, browser tab management, or WebSocket disconnections Because these events reset the idle timer, a session might remain active longer than the configured timeout period even without direct terminal commands. If your security requirements mandate strict session duration limits regardless of activity, use the *Maximum session duration* setting in addition to idle timeout. For more information, see [Specify maximum session duration](session-preferences-max-timeout.md). **To allow idle session timeout (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Session Manager**. 1. Choose the **Preferences** tab, and then choose **Edit**. 1. Specify the amount of time to allow a user to be inactive before a session ends in the **minutes** field under **Idle session timeout**. 1. Choose **Save**. # Specify maximum session duration Session Manager, a tool in AWS Systems Manager, allows you to specify the maximum duration of a session before it ends. By default, sessions do not have a maximum duration. The value you specify for maximum session duration must be between 1 and 1,440 minutes. **To specify maximum session duration (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Session Manager**. 1. Choose the **Preferences** tab, and then choose **Edit**. 1. Select the check box next to **Enable maximum session duration**. 1. Specify the maximum duration of session before it ends in the **minutes** field under **Maximum session duration**. 1. Choose **Save**. # Allow configurable shell profiles By default, sessions on EC2 instances for Linux start using the Bourne shell (sh). However, you might prefer to use another shell like bash. By allowing configurable shell profiles, you can customize preferences within sessions such as shell preferences, environment variables, working directories, and running multiple commands when a session is started. **Important** Systems Manager doesn't check the commands or scripts in your shell profile to see what changes they would make to an instance before they're run. To restrict a user’s ability to modify commands or scripts entered in their shell profile, we recommend the following: Create a customized Session-type document for your AWS Identity and Access Management (IAM) users and roles. Then modify the IAM policy for these users and roles so the `StartSession` API operation can only use the Session-type document you have created for them. For information see, [Create a Session Manager preferences document (command line)](getting-started-create-preferences-cli.md) and [Quickstart end user policies for Session Manager](getting-started-restrict-access-quickstart.md#restrict-access-quickstart-end-user). Modify the IAM policy for your IAM users and roles to deny access to the `UpdateDocument` API operation for the Session-type document resource you create. This allows your users and roles to use the document you created for their session preferences without allowing them to modify any of the settings. **To turn on configurable shell profiles** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Session Manager**. 1. Choose the **Preferences** tab, and then choose **Edit**. 1. Specify the environment variables, shell preferences, or commands you want to run when your session starts in the fields for the applicable operating systems. 1. Choose **Save**. The following are some example commands that can be added to your shell profile. Change to the bash shell and change to the /usr directory on Linux instances. ``` exec /bin/bash cd /usr ``` Output a timestamp and welcome message at the start of a session. ------ #### [ Linux & macOS ] ``` timestamp=$(date '+%Y-%m-%dT%H:%M:%SZ') user=$(whoami) echo $timestamp && echo "Welcome $user"'!' echo "You have logged in to a production instance. Note that all session activity is being logged." ``` ------ #### [ Windows ] ``` $timestamp = (Get-Date).ToString("yyyy-MM-ddTH:mm:ssZ") $splitName = (whoami).Split("\") $user = $splitName[1] Write-Host $timestamp Write-Host "Welcome $user!" Write-Host "You have logged in to a production instance. Note that all session activity is being logged." ``` ------ View dynamic system activity at the start of a session. ------ #### [ Linux & macOS ] ``` top ``` ------ #### [ Windows ] ``` while ($true) { Get-Process | Sort-Object -Descending CPU | Select-Object -First 30; ` Start-Sleep -Seconds 2; cls Write-Host "Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName"; Write-Host "------- ------ ----- ----- ----- ------ -- -----------"} ``` ------ # Turn on Run As support for Linux and macOS managed nodes By default, Session Manager authenticates connections using the credentials of the system-generated `ssm-user` account that is created on a managed node. (On Linux and macOS machines, this account is added to `/etc/sudoers/`.) If you choose, you can instead authenticate sessions using the credentials of an operating system (OS) user account, or a domain user for instances joined to an Active Directory. In this case, Session Manager verifies that the OS account that you specified exists on the node, or in the domain, before starting the session. If you attempt to start a session using an OS account that doesn't exist on the node, or in the domain, the connection fails. **Note** Session Manager does not support using an operating system's `root` user account to authenticate connections. For sessions that are authenticated using an OS user account, the node's OS-level and directory policies, like login restrictions or system resource usage restrictions, might not apply. **How it works** If you turn on Run As support for sessions, the system checks for access permissions as follows: 1. For the user who is starting the session, has their IAM entity (user or role) been tagged with `SSMSessionRunAs = os user account name`? If Yes, does the OS user name exist on the managed node? If it does, start the session. If it doesn't, don't allow a session to start. If the IAM entity has *not* been tagged with `SSMSessionRunAs = os user account name`, continue to step 2. 1. If the IAM entity hasn't been tagged with `SSMSessionRunAs = os user account name`, has an OS user name been specified in the AWS account's Session Manager preferences? If Yes, does the OS user name exist on the managed node? If it does, start the session. If it doesn't, don't allow a session to start. **Note** When you activate Run As support, it prevents Session Manager from starting sessions using the `ssm-user` account on a managed node. This means that if Session Manager fails to connect using the specified OS user account, it doesn't fall back to connecting using the default method. If you activate Run As without specifying an OS account or tagging an IAM entity, and you have not specified an OS account in Session Manager preferences, session connection attempts will fail. **To turn on Run As support for Linux and macOS managed nodes** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Session Manager**. 1. Choose the **Preferences** tab, and then choose **Edit**. 1. Select the check box next to **Enable Run As support for Linux instances**. 1. Do one of the following: + **Option 1**: In the **Operating system user name** field, enter the name of the OS user account that you want to use to start sessions. Using this option, all sessions are run by the same OS user for all users in your AWS account who connect using Session Manager. + **Option 2** (Recommended): Choose the **Open the IAM console** link. In the navigation pane, choose either **Users** or **Roles**. Choose the entity (user or role) to add tags to, and then choose the **Tags** tab. Enter `SSMSessionRunAs` for the key name. Enter the name of an OS user account for the key value. Choose **Save changes**. Using this option, you can specify unique OS users for different IAM entities if you choose. For more information about tagging IAM entities (users or roles), see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide*. The following is an example. ![\[Screenshot of specifying tags for Session Manager Run As permission.\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/images/ssn-run-as-tags.png) 1. Choose **Save**. # Turn on KMS key encryption of session data (console) Use AWS Key Management Service (AWS KMS) to create and manage encryption keys. With AWS KMS, you can control the use of encryption across a wide range of AWS services and in your applications. You can specify that session data transmitted between your managed nodes and the local machines of users in your AWS account is encrypted using KMS key encryption. (This is in addition to the TLS 1.2/1.3 encryption that AWS already provides by default.) To encrypt Session Manager session data, create a *symmetric* KMS key using AWS KMS. AWS KMS encryption is available for `Standard_Stream`, `InteractiveCommands`, and `NonInteractiveCommands` session types. To use the option to encrypt session data using a key created in AWS KMS, version 2.3.539.0 or later of AWS Systems Manager SSM Agent must be installed on the managed node. **Note** You must allow AWS KMS encryption in order to reset passwords on your managed nodes from the AWS Systems Manager console. For more information, see [Reset a password on a managed node](fleet-manager-reset-password.md#managed-instance-reset-a-password). You can use a key that you created in your AWS account. You can also use a key that was created in a different AWS account. The creator of the key in a different AWS account must provide you with the permissions needed to use the key. After you turn on KMS key encryption for your session data, both the users who start sessions and the managed nodes that they connect to must have permission to use the key. You provide permission to use the KMS key with Session Manager through AWS Identity and Access Management (IAM) policies. For information, see the following topics: + Add AWS KMS permissions for users in your account: [Sample IAM policies for Session Manager](getting-started-restrict-access-quickstart.md). + Add AWS KMS permissions for managed nodes in your account: [Step 2: Verify or add instance permissions for Session Manager](session-manager-getting-started-instance-profile.md). For more information about creating and managing KMS keys, see the [https://docs.aws.amazon.com/kms/latest/developerguide/](https://docs.aws.amazon.com/kms/latest/developerguide/). For information about using the AWS CLI to turn on KMS key encryption of session data in your account, see [Create a Session Manager preferences document (command line)](getting-started-create-preferences-cli.md) or [Update Session Manager preferences (command line)](getting-started-configure-preferences-cli.md). **Note** There is a charge to use KMS keys. For information, see [AWS Key Management Service pricing](https://aws.amazon.com/kms/pricing/). **To turn on KMS key encryption of session data (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Session Manager**. 1. Choose the **Preferences** tab, and then choose **Edit**. 1. Select the check box next to **Enable KMS encryption**. 1. Do one of the following: + Choose the button next to **Select a KMS key in my current account**, then select a key from the list. -or- Choose the button next to **Enter a KMS key alias or KMS key ARN**. Manually enter a KMS key alias for a key created in your current account, or enter the key Amazon Resource Name (ARN) for a key in another account. The following are examples: + Key alias: `alias/my-kms-key-alias` + Key ARN: `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-12345EXAMPLE` -or- Choose **Create new key** to create a new KMS key in your account. After you create the new key, return to the **Preferences** tab and select the key for encrypting session data in your account. For more information about sharing keys, see [Allowing External AWS accounts to Access a key](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying.html#key-policy-modifying-external-accounts) in the *AWS Key Management Service Developer Guide*. 1. Choose **Save**. # Create a Session Manager preferences document (command line) Use the following procedure to create SSM documents that define your preferences for AWS Systems Manager Session Manager sessions. You can use the document to configure session options including data encryption, session duration, and logging. For example, you can specify whether to store session log data in an Amazon Simple Storage Service (Amazon S3) bucket or Amazon CloudWatch Logs log group. You can create documents that define general preferences for all sessions for an AWS account and AWS Region, or that define preferences for individual sessions. **Note** You can also configure general session preferences by using the Session Manager console. Documents used to set Session Manager preferences must have a `sessionType` of `Standard_Stream`. For more information about Session documents, see [Session document schema](session-manager-schema.md). For information about using the command line to update existing Session Manager preferences, see [Update Session Manager preferences (command line)](getting-started-configure-preferences-cli.md). For an example of how to create session preferences using CloudFormation, see [Create a Systems Manager document for Session Manager preferences](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-document.html#aws-resource-ssm-document--examples) in the *AWS CloudFormation User Guide*. **Note** This procedure describes how to create documents for setting Session Manager preferences at the AWS account level. To create documents that will be used for setting session-level preferences, specify a value other than `SSM-SessionManagerRunShell` for the file name related command inputs . To use your document to set preferences for sessions started from the AWS Command Line Interface (AWS CLI), provide the document name as the `--document-name` parameter value. To set preferences for sessions started from the Session Manager console, you can type or select the name of your document from a list. **To create Session Manager preferences (command line)** 1. Create a JSON file on your local machine with a name such as `SessionManagerRunShell.json`, and then paste the following content into it. ``` { "schemaVersion": "1.0", "description": "Document to hold regional settings for Session Manager", "sessionType": "Standard_Stream", "inputs": { "s3BucketName": "", "s3KeyPrefix": "", "s3EncryptionEnabled": true, "cloudWatchLogGroupName": "", "cloudWatchEncryptionEnabled": true, "cloudWatchStreamingEnabled": false, "kmsKeyId": "", "runAsEnabled": false, "runAsDefaultUser": "", "idleSessionTimeout": "", "maxSessionDuration": "", "shellProfile": { "windows": "date", "linux": "pwd;ls" } } } ``` You can also pass values to your session preferences using parameters instead of hardcoding the values as shown in the following example. ``` { "schemaVersion":"1.0", "description":"Session Document Parameter Example JSON Template", "sessionType":"Standard_Stream", "parameters":{ "s3BucketName":{ "type":"String", "default":"" }, "s3KeyPrefix":{ "type":"String", "default":"" }, "s3EncryptionEnabled":{ "type":"Boolean", "default":"false" }, "cloudWatchLogGroupName":{ "type":"String", "default":"" }, "cloudWatchEncryptionEnabled":{ "type":"Boolean", "default":"false" } }, "inputs":{ "s3BucketName":"{{s3BucketName}}", "s3KeyPrefix":"{{s3KeyPrefix}}", "s3EncryptionEnabled":"{{s3EncryptionEnabled}}", "cloudWatchLogGroupName":"{{cloudWatchLogGroupName}}", "cloudWatchEncryptionEnabled":"{{cloudWatchEncryptionEnabled}}", "kmsKeyId":"" } } ``` 1. Specify where you want to send session data. You can specify an S3 bucket name (with an optional prefix) or a CloudWatch Logs log group name. If you want to further encrypt data between local client and managed nodes, provide the KMS key to use for encryption. The following is an example. ``` { "schemaVersion": "1.0", "description": "Document to hold regional settings for Session Manager", "sessionType": "Standard_Stream", "inputs": { "s3BucketName": "amzn-s3-demo-bucket", "s3KeyPrefix": "MyS3Prefix", "s3EncryptionEnabled": true, "cloudWatchLogGroupName": "MyLogGroupName", "cloudWatchEncryptionEnabled": true, "cloudWatchStreamingEnabled": false, "kmsKeyId": "MyKMSKeyID", "runAsEnabled": true, "runAsDefaultUser": "MyDefaultRunAsUser", "idleSessionTimeout": "20", "maxSessionDuration": "60", "shellProfile": { "windows": "MyCommands", "linux": "MyCommands" } } } ``` **Note** If you don't want to encrypt the session log data, change `true` to `false` for `s3EncryptionEnabled`. If you aren't sending logs to either an Amazon S3 bucket or a CloudWatch Logs log group, don't want to encrypt active session data, or don't want to turn on Run As support for the sessions in your account, you can delete the lines for those options. Make sure the last line in the `inputs` section doesn't end with a comma. If you add a KMS key ID to encrypt your session data, both the users who start sessions and the managed nodes that they connect to must have permission to use the key. You provide permission to use the KMS key with Session Manager through IAM policies. For information, see the following topics: Add AWS KMS permissions for users in your account: [Sample IAM policies for Session Manager](getting-started-restrict-access-quickstart.md) Add AWS KMS permissions for managed nodes in your account: [Step 2: Verify or add instance permissions for Session Manager](session-manager-getting-started-instance-profile.md) 1. Save the file. 1. In the directory where you created the JSON file, run the following command. ------ #### [ Linux & macOS ] ``` aws ssm create-document \ --name SSM-SessionManagerRunShell \ --content "file://SessionManagerRunShell.json" \ --document-type "Session" \ --document-format JSON ``` ------ #### [ Windows ] ``` aws ssm create-document ^ --name SSM-SessionManagerRunShell ^ --content "file://SessionManagerRunShell.json" ^ --document-type "Session" ^ --document-format JSON ``` ------ #### [ PowerShell ] ``` New-SSMDocument ` -Name "SSM-SessionManagerRunShell" ` -Content (Get-Content -Raw SessionManagerRunShell.json) ` -DocumentType "Session" ` -DocumentFormat JSON ``` ------ If successful, the command returns output similar to the following. ``` { "DocumentDescription": { "Status": "Creating", "Hash": "ce4fd0a2ab9b0fae759004ba603174c3ec2231f21a81db8690a33eb66EXAMPLE", "Name": "SSM-SessionManagerRunShell", "Tags": [], "DocumentType": "Session", "PlatformTypes": [ "Windows", "Linux" ], "DocumentVersion": "1", "HashType": "Sha256", "CreatedDate": 1547750660.918, "Owner": "111122223333", "SchemaVersion": "1.0", "DefaultVersion": "1", "DocumentFormat": "JSON", "LatestVersion": "1" } } ``` # Update Session Manager preferences (command line) The following procedure describes how to use your preferred command line tool to make changes to the AWS Systems Manager Session Manager preferences for your AWS account in the selected AWS Region. Use Session Manager preferences to specify options for logging session data in an Amazon Simple Storage Service (Amazon S3) bucket or Amazon CloudWatch Logs log group. You can also use Session Manager preferences to encrypt your session data. **To update Session Manager preferences (command line)** 1. Create a JSON file on your local machine with a name such as `SessionManagerRunShell.json`, and then paste the following content into it. ``` { "schemaVersion": "1.0", "description": "Document to hold regional settings for Session Manager", "sessionType": "Standard_Stream", "inputs": { "s3BucketName": "", "s3KeyPrefix": "", "s3EncryptionEnabled": true, "cloudWatchLogGroupName": "", "cloudWatchEncryptionEnabled": true, "cloudWatchStreamingEnabled": false, "kmsKeyId": "", "runAsEnabled": true, "runAsDefaultUser": "", "idleSessionTimeout": "", "maxSessionDuration": "", "shellProfile": { "windows": "date", "linux": "pwd;ls" } } } ``` 1. Specify where you want to send session data. You can specify an S3 bucket name (with an optional prefix) or a CloudWatch Logs log group name. If you want to further encrypt data between local client and managed nodes, provide the AWS KMS key to use for encryption. The following is an example. ``` { "schemaVersion": "1.0", "description": "Document to hold regional settings for Session Manager", "sessionType": "Standard_Stream", "inputs": { "s3BucketName": "amzn-s3-demo-bucket", "s3KeyPrefix": "MyS3Prefix", "s3EncryptionEnabled": true, "cloudWatchLogGroupName": "MyLogGroupName", "cloudWatchEncryptionEnabled": true, "cloudWatchStreamingEnabled": false, "kmsKeyId": "MyKMSKeyID", "runAsEnabled": true, "runAsDefaultUser": "MyDefaultRunAsUser", "idleSessionTimeout": "20", "maxSessionDuration": "60", "shellProfile": { "windows": "MyCommands", "linux": "MyCommands" } } } ``` **Note** If you don't want to encrypt the session log data, change `true` to `false` for `s3EncryptionEnabled`. If you aren't sending logs to either an Amazon S3 bucket or a CloudWatch Logs log group, don't want to encrypt active session data, or don't want to turn on Run As support for the sessions in your account, you can delete the lines for those options. Make sure the last line in the `inputs` section doesn't end with a comma. If you add a KMS key ID to encrypt your session data, both the users who start sessions and the managed nodes that they connect to must have permission to use the key. You provide permission to use the KMS key with Session Manager through AWS Identity and Access Management (IAM) policies. For information, see the following topics: Add AWS KMS permissions for users in your account: [Sample IAM policies for Session Manager](getting-started-restrict-access-quickstart.md). Add AWS KMS permissions for managed nodes in your account: [Step 2: Verify or add instance permissions for Session Manager](session-manager-getting-started-instance-profile.md). 1. Save the file. 1. In the directory where you created the JSON file, run the following command. ------ #### [ Linux & macOS ] ``` aws ssm update-document \ --name "SSM-SessionManagerRunShell" \ --content "file://SessionManagerRunShell.json" \ --document-version "\$LATEST" ``` ------ #### [ Windows ] ``` aws ssm update-document ^ --name "SSM-SessionManagerRunShell" ^ --content "file://SessionManagerRunShell.json" ^ --document-version "$LATEST" ``` ------ #### [ PowerShell ] ``` Update-SSMDocument ` -Name "SSM-SessionManagerRunShell" ` -Content (Get-Content -Raw SessionManagerRunShell.json) ` -DocumentVersion '$LATEST' ``` ------ If successful, the command returns output similar to the following. ``` { "DocumentDescription": { "Status": "Updating", "Hash": "ce4fd0a2ab9b0fae759004ba603174c3ec2231f21a81db8690a33eb66EXAMPLE", "Name": "SSM-SessionManagerRunShell", "Tags": [], "DocumentType": "Session", "PlatformTypes": [ "Windows", "Linux" ], "DocumentVersion": "2", "HashType": "Sha256", "CreatedDate": 1537206341.565, "Owner": "111122223333", "SchemaVersion": "1.0", "DefaultVersion": "1", "DocumentFormat": "JSON", "LatestVersion": "2" } } ``` # Step 5: (Optional) Restrict access to commands in a session You can restrict the commands that a user can run in an AWS Systems Manager Session Manager session by using a custom `Session` type AWS Systems Manager (SSM) document. In the document, you define the command that is run when the user starts a session and the parameters that the user can provide to the command. The `Session` document `schemaVersion` must be 1.0, and the `sessionType` of the document must be `InteractiveCommands`. You can then create AWS Identity and Access Management (IAM) policies that allow users to access only the `Session` documents that you define. For more information about using IAM policies to restrict access to commands in a session, see [IAM policy examples for interactive commands](#interactive-command-policy-examples). Documents with the `sessionType` of `InteractiveCommands` are only supported for sessions started from the AWS Command Line Interface (AWS CLI). The user provides the custom document name as the `--document-name` parameter value and provides any command parameter values using the `--parameters` option. For more information about running interactive commands, see [Starting a session (interactive and noninteractive commands)](session-manager-working-with-sessions-start.md#sessions-start-interactive-commands). Use following procedure to create a custom `Session` type SSM document that defines the command a user is allowed to run. ## Restrict access to commands in a session (console) **To restrict the commands a user can run in a Session Manager session (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Documents**. 1. Choose **Create command or session**. 1. For **Name**, enter a descriptive name for the document. 1. For **Document type**, choose **Session document**. 1. Enter your document content that defines the command a user can run in a Session Manager session using JSON or YAML, as shown in the following example. ------ #### [ YAML ] ``` --- schemaVersion: '1.0' description: Document to view a log file on a Linux instance sessionType: InteractiveCommands parameters: logpath: type: String description: The log file path to read. default: "/var/log/amazon/ssm/amazon-ssm-agent.log" allowedPattern: "^[a-zA-Z0-9-_/]+(.log)$" properties: linux: commands: "tail -f {{ logpath }}" runAsElevated: true ``` ------ #### [ JSON ] ``` { "schemaVersion": "1.0", "description": "Document to view a log file on a Linux instance", "sessionType": "InteractiveCommands", "parameters": { "logpath": { "type": "String", "description": "The log file path to read.", "default": "/var/log/amazon/ssm/amazon-ssm-agent.log", "allowedPattern": "^[a-zA-Z0-9-_/]+(.log)$" } }, "properties": { "linux": { "commands": "tail -f {{ logpath }}", "runAsElevated": true } } } ``` ------ 1. Choose **Create document**. ## Restrict access to commands in a session (command line) **Before you begin** If you haven't already, install and configure the AWS Command Line Interface (AWS CLI) or the AWS Tools for PowerShell. For information, see [Installing or updating the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [Installing the AWS Tools for PowerShell](https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up.html). **To restrict the commands a user can run in a Session Manager session (command line)** 1. Create a JSON or YAML file for your document content that defines the command a user can run in a Session Manager session, as shown in the following example. ------ #### [ YAML ] ``` --- schemaVersion: '1.0' description: Document to view a log file on a Linux instance sessionType: InteractiveCommands parameters: logpath: type: String description: The log file path to read. default: "/var/log/amazon/ssm/amazon-ssm-agent.log" allowedPattern: "^[a-zA-Z0-9-_/]+(.log)$" properties: linux: commands: "tail -f {{ logpath }}" runAsElevated: true ``` ------ #### [ JSON ] ``` { "schemaVersion": "1.0", "description": "Document to view a log file on a Linux instance", "sessionType": "InteractiveCommands", "parameters": { "logpath": { "type": "String", "description": "The log file path to read.", "default": "/var/log/amazon/ssm/amazon-ssm-agent.log", "allowedPattern": "^[a-zA-Z0-9-_/]+(.log)$" } }, "properties": { "linux": { "commands": "tail -f {{ logpath }}", "runAsElevated": true } } } ``` ------ 1. Run the following commands to create an SSM document using your content that defines the command a user can run in a Session Manager session. ------ #### [ Linux & macOS ] ``` aws ssm create-document \ --content file://path/to/file/documentContent.json \ --name "exampleAllowedSessionDocument" \ --document-type "Session" ``` ------ #### [ Windows ] ``` aws ssm create-document ^ --content file://C:\path\to\file\documentContent.json ^ --name "exampleAllowedSessionDocument" ^ --document-type "Session" ``` ------ #### [ PowerShell ] ``` $json = Get-Content -Path "C:\path\to\file\documentContent.json" | Out-String New-SSMDocument ` -Content $json ` -Name "exampleAllowedSessionDocument" ` -DocumentType "Session" ``` ------ ## Interactive command parameters and the AWS CLI There are a variety of ways you can provide interactive command parameters when using the AWS CLI. Depending on the operating system (OS) of your client machine that you use to connect to managed nodes with the AWS CLI, the syntax you provide for commands that contain special or escape characters might differ. The following examples show some of the different ways you can provide command parameters when using the AWS CLI, and how to handle special or escape characters. Parameters stored in Parameter Store can be referenced in the AWS CLI for your command parameters as shown in the following example. ------ #### [ Linux & macOS ] ``` aws ssm start-session \ --target instance-id \ --document-name MyInteractiveCommandDocument \ --parameters '{"command":["{{ssm:mycommand}}"]}' ``` ------ #### [ Windows ] ``` aws ssm start-session ^ --target instance-id ^ --document-name MyInteractiveCommandDocument ^ --parameters '{"command":["{{ssm:mycommand}}"]}' ``` ------ The following example shows how you can use a shorthand syntax with the AWS CLI to pass parameters. ------ #### [ Linux & macOS ] ``` aws ssm start-session \ --target instance-id \ --document-name MyInteractiveCommandDocument \ --parameters command="ifconfig" ``` ------ #### [ Windows ] ``` aws ssm start-session ^ --target instance-id ^ --document-name MyInteractiveCommandDocument ^ --parameters command="ipconfig" ``` ------ You can also provide parameters in JSON as shown in the following example. ------ #### [ Linux & macOS ] ``` aws ssm start-session \ --target instance-id \ --document-name MyInteractiveCommandDocument \ --parameters '{"command":["ifconfig"]}' ``` ------ #### [ Windows ] ``` aws ssm start-session ^ --target instance-id ^ --document-name MyInteractiveCommandDocument ^ --parameters '{"command":["ipconfig"]}' ``` ------ Parameters can also be stored in a JSON file and provided to the AWS CLI as shown in the following example. For more information about using AWS CLI parameters from a file, see [Loading AWS CLI parameters from a file](https://docs.aws.amazon.com/cli/latest/userguide/;cli-usage-parameters-file.html) in the *AWS Command Line Interface User Guide*. ``` { "command": [ "my command" ] } ``` ------ #### [ Linux & macOS ] ``` aws ssm start-session \ --target instance-id \ --document-name MyInteractiveCommandDocument \ --parameters file://complete/path/to/file/parameters.json ``` ------ #### [ Windows ] ``` aws ssm start-session ^ --target instance-id ^ --document-name MyInteractiveCommandDocument ^ --parameters file://complete/path/to/file/parameters.json ``` ------ You can also generate an AWS CLI skeleton from a JSON input file as shown in the following example. For more information about generating AWS CLI skeletons from JSON input files, see [Generating AWS CLI skeleton and input parameters from a JSON or YAML input file](https://docs.aws.amazon.com/cli/latest/userguide/;cli-usage-skeleton.html) in the *AWS Command Line Interface User Guide*. ``` { "Target": "instance-id", "DocumentName": "MyInteractiveCommandDocument", "Parameters": { "command": [ "my command" ] } } ``` ------ #### [ Linux & macOS ] ``` aws ssm start-session \ --cli-input-json file://complete/path/to/file/parameters.json ``` ------ #### [ Windows ] ``` aws ssm start-session ^ --cli-input-json file://complete/path/to/file/parameters.json ``` ------ To escape characters inside quotation marks, you must add additional backslashes to the escape characters as shown in the following example. ------ #### [ Linux & macOS ] ``` aws ssm start-session \ --target instance-id \ --document-name MyInteractiveCommandDocument \ --parameters '{"command":["printf \"abc\\\\tdef\""]}' ``` ------ #### [ Windows ] ``` aws ssm start-session ^ --target instance-id ^ --document-name MyInteractiveCommandDocument ^ --parameters '{"command":["printf \"abc\\\\tdef\""]}' ``` ------ For information about using quotation marks with command parameters in the AWS CLI, see [Using quotation marks with strings in the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/;cli-usage-parameters-quoting-strings.html) in the *AWS Command Line Interface User Guide*. ## IAM policy examples for interactive commands You can create IAM policies that allow users to access only the `Session` documents you define. This restricts the commands a user can run in a Session Manager session to only the commands defined in your custom `Session` type SSM documents. **Allow a user to run an interactive command on a single managed node** **** ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":"ssm:StartSession", "Resource":[ "arn:aws:ec2:us-east-1:444455556666:instance/i-02573cafcfEXAMPLE", "arn:aws:ssm:us-east-1:444455556666:document/allowed-session-document" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] } ] } ``` **Allow a user to run an interactive command on all managed nodes** **** ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":"ssm:StartSession", "Resource":[ "arn:aws:ec2:us-east-1:444455556666:instance/*", "arn:aws:ssm:us-east-1:444455556666:document/allowed-session-document" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] } ] } ``` **Allow a user to run multiple interactive commands on all managed nodes** **** ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":"ssm:StartSession", "Resource":[ "arn:aws:ec2:us-east-1:444455556666:instance/*", "arn:aws:ssm:us-east-1:444455556666:document/allowed-session-document", "arn:aws:ssm:us-east-1:444455556666:document/allowed-session-document-2" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] } ] } ``` # Step 6: (Optional) Use AWS PrivateLink to set up a VPC endpoint for Session Manager You can further improve the security posture of your managed nodes by configuring AWS Systems Manager to use an interface virtual private cloud (VPC) endpoint. Interface endpoints are powered by AWS PrivateLink, a technology that allows you to privately access Amazon Elastic Compute Cloud (Amazon EC2) and Systems Manager APIs by using private IP addresses. AWS PrivateLink restricts all network traffic between your managed nodes, Systems Manager, and Amazon EC2 to the Amazon network. (Managed nodes don't have access to the internet.) Also, you don't need an internet gateway, a NAT device, or a virtual private gateway. For information about creating a VPC endpoint, see [Improve the security of EC2 instances by using VPC endpoints for Systems Manager](setup-create-vpc.md). The alternative to using a VPC endpoint is to allow outbound internet access on your managed nodes. In this case, the managed nodes must also allow HTTPS (port 443) outbound traffic to the following endpoints: + `ec2messages.region.amazonaws.com` + `ssm.region.amazonaws.com` + `ssmmessages.region.amazonaws.com` Systems Manager uses the last of these endpoints, `ssmmessages.region.amazonaws.com`, to make calls from SSM Agent to the Session Manager service in the cloud. To use optional features like AWS Key Management Service (AWS KMS) encryption, streaming logs to Amazon CloudWatch Logs (CloudWatch Logs), and sending logs to Amazon Simple Storage Service (Amazon S3) you must allow HTTPS (port 443) outbound traffic to the following endpoints: + `kms.region.amazonaws.com` + `logs.region.amazonaws.com` + `s3.region.amazonaws.com` For more information about required endpoints for Systems Manager, see [Reference: ec2messages, ssmmessages, and other API operations](systems-manager-setting-up-messageAPIs.md). # Step 7: (Optional) Turn on or turn off ssm-user account administrative permissions Starting with version 2.3.50.0 of AWS Systems Manager SSM Agent, the agent creates a local user account called `ssm-user` and adds it to `/etc/sudoers` (Linux and macOS) or to the Administrators group (Windows). On agent versions earlier than 2.3.612.0, the account is created the first time SSM Agent starts or restarts after installation. On version 2.3.612.0 and later, the `ssm-user` account is created the first time a session is started on a node. This `ssm-user` is the default operating system (OS) user when a AWS Systems Manager Session Manager session is started. SSM Agent version 2.3.612.0 was released on May 8th, 2019. If you want to prevent Session Manager users from running administrative commands on a node, you can update the `ssm-user` account permissions. You can also restore these permissions after they have been removed. **Topics** + [Managing ssm-user sudo account permissions on Linux and macOS](#ssm-user-permissions-linux) + [Managing ssm-user Administrator account permissions on Windows Server](#ssm-user-permissions-windows) ## Managing ssm-user sudo account permissions on Linux and macOS Use one of the following procedures to turn on or turn off the ssm-user account sudo permissions on Linux and macOS managed nodes. **Use Run Command to modify ssm-user sudo permissions (console)** + Use the procedure in [Running commands from the console](running-commands-console.md) with the following values: + For **Command document**, choose `AWS-RunShellScript`. + To remove sudo access, in the **Command parameters** area, paste the following in the **Commands** box. ``` cd /etc/sudoers.d echo "#User rules for ssm-user" > ssm-agent-users ``` -or- To restore sudo access, in the **Command parameters** area, paste the following in the **Commands** box. ``` cd /etc/sudoers.d echo "ssm-user ALL=(ALL) NOPASSWD:ALL" > ssm-agent-users ``` **Use the command line to modify ssm-user sudo permissions (AWS CLI)** 1. Connect to the managed node and run the following command. ``` sudo -s ``` 1. Change the working directory using the following command. ``` cd /etc/sudoers.d ``` 1. Open the file named `ssm-agent-users` for editing. 1. To remove sudo access, delete the following line. ``` ssm-user ALL=(ALL) NOPASSWD:ALL ``` -or- To restore sudo access, add the following line. ``` ssm-user ALL=(ALL) NOPASSWD:ALL ``` 1. Save the file. ## Managing ssm-user Administrator account permissions on Windows Server Use one of the following procedures to turn on or turn off the ssm-user account Administrator permissions on Windows Server managed nodes. **Use Run Command to modify Administrator permissions (console)** + Use the procedure in [Running commands from the console](running-commands-console.md) with the following values: For **Command document**, choose `AWS-RunPowerShellScript`. To remove administrative access, in the **Command parameters** area, paste the following in the **Commands** box. ``` net localgroup "Administrators" "ssm-user" /delete ``` -or- To restore administrative access, in the **Command parameters** area, paste the following in the **Commands** box. ``` net localgroup "Administrators" "ssm-user" /add ``` **Use the PowerShell or command prompt window to modify Administrator permissions** 1. Connect to the managed node and open the PowerShell or Command Prompt window. 1. To remove administrative access, run the following command. ``` net localgroup "Administrators" "ssm-user" /delete ``` -or- To restore administrative access, run the following command. ``` net localgroup "Administrators" "ssm-user" /add ``` **Use the Windows console to modify Administrator permissions** 1. Connect to the managed node and open the PowerShell or Command Prompt window. 1. From the command line, run `lusrmgr.msc` to open the **Local Users and Groups** console. 1. Open the **Users** directory, and then open **ssm-user**. 1. On the **Member Of** tab, do one of the following: + To remove administrative access, select **Administrators**, and then choose **Remove**. -or- To restore administrative access, enter **Administrators** in the text box, and then choose **Add**. 1. Choose **OK**. # Step 8: (Optional) Allow and control permissions for SSH connections through Session Manager You can allow users in your AWS account to use the AWS Command Line Interface (AWS CLI) to establish Secure Shell (SSH) connections to managed nodes using AWS Systems Manager Session Manager. Users who connect using SSH can also copy files between their local machines and managed nodes using Secure Copy Protocol (SCP). You can use this functionality to connect to managed nodes without opening inbound ports or maintaining bastion hosts. When you establish SSH connections through Session Manager, the AWS CLI and SSM Agent create secure WebSocket connections over TLS to Session Manager endpoints. The SSH session runs within this encrypted tunnel, providing an additional layer of security without requiring inbound ports to be opened on your managed nodes. After allowing SSH connections, you can use AWS Identity and Access Management (IAM) policies to explicitly allow or deny users, groups, or roles to make SSH connections using Session Manager. **Note** Logging isn't available for Session Manager sessions that connect through port forwarding or SSH. This is because SSH encrypts all session data within the secure TLS connection established between the AWS CLI and Session Manager endpoints, and Session Manager only serves as a tunnel for SSH connections. **Topics** + [Allowing SSH connections for Session Manager](#ssh-connections-enable) + [Controlling user permissions for SSH connections through Session Manager](#ssh-connections-permissions) ## Allowing SSH connections for Session Manager Use the following steps to allow SSH connections through Session Manager on a managed node. **To allow SSH connections for Session Manager** 1. On the managed node to which you want to allow SSH connections, do the following: + Ensure that SSH is running on the managed node. (You can close inbound ports on the node.) + Ensure that SSM Agent version 2.3.672.0 or later is installed on the managed node. For information about installing or updating SSM Agent on a managed node, see the following topics: + [Manually installing and uninstalling SSM Agent on EC2 instances for Windows Server](manually-install-ssm-agent-windows.md). + [Manually installing and uninstalling SSM Agent on EC2 instances for Linux](manually-install-ssm-agent-linux.md) + [Manually installing and uninstalling SSM Agent on EC2 instances for macOS](manually-install-ssm-agent-macos.md) + [How to install the SSM Agent on hybrid Windows nodes](hybrid-multicloud-ssm-agent-install-windows.md) + [How to install the SSM Agent on hybrid Linux nodes](hybrid-multicloud-ssm-agent-install-linux.md) **Note** To use Session Manager with on-premises servers, edge devices, and virtual machines (VMs) that you activated as managed nodes, you must use the advanced-instances tier. For more information about advanced instances, see [Configuring instance tiers](fleet-manager-configure-instance-tiers.md). 1. On the local machine from which you want to connect to a managed node using SSH, do the following: + Ensure that version 1.1.23.0 or later of the Session Manager plugin is installed. For information about installing the Session Manager plugin, see [Install the Session Manager plugin for the AWS CLI](session-manager-working-with-install-plugin.md). + Update the SSH configuration file to allow running a proxy command that starts a Session Manager session and transfer all data through the connection. **Linux and macOS** **Tip** The SSH configuration file is typically located at `~/.ssh/config`. Add the following to the configuration file on the local machine. ``` # SSH over Session Manager Host i-* mi-* ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'" User ec2-user ``` ** Windows ** **Tip** The SSH configuration file is typically located at `C:\Users\\.ssh\config`. Add the following to the configuration file on the local machine. ``` # SSH over Session Manager Host i-* mi-* ProxyCommand C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters portNumber=%p" ``` + Create or verify that you have a Privacy Enhanced Mail certificate (a PEM file), or at minimum a public key, to use when establishing connections to managed nodes. This must be a key that is already associated with the managed node. The permissions of your private key file must be set so that only you can read it. You can use the following command to set the permissions of your private key file so that only you can read it. ``` chmod 400 .pem ``` For example, for an Amazon Elastic Compute Cloud (Amazon EC2) instance, the key pair file you created or selected when you created the instance. (You specify the path to the certificate or key as part of the command to start a session. For information about starting a session using SSH, see [Starting a session (SSH)](session-manager-working-with-sessions-start.md#sessions-start-ssh).) ## Controlling user permissions for SSH connections through Session Manager After you enable SSH connections through Session Manager on a managed node, you can use IAM policies to allow or deny users, groups, or roles the ability to make SSH connections through Session Manager. **To use an IAM policy to allow SSH connections through Session Manager** + Use one of the following options: + **Option 1**: Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). In the navigation pane, choose **Policies**, and then update the permissions policy for the user or role you want to allow to start SSH connections through Session Manager. For example, add the following element to the Quickstart policy you created in [Quickstart end user policies for Session Manager](getting-started-restrict-access-quickstart.md#restrict-access-quickstart-end-user). Replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ssm:StartSession", "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/instance-id", "arn:aws:ssm:*:*:document/AWS-StartSSHSession" ] }, { "Effect": "Allow", "Action": "ssmmessages:OpenDataChannel", "Resource": "arn:aws:ssm:*:*:session/${aws:userid}-*" } ] } ``` ------ + **Option 2**: Attach an inline policy to a user policy by using the AWS Management Console, the AWS CLI, or the AWS API. Using the method of your choice, attach the policy statement in **Option 1** to the policy for an AWS user, group, or role. For information, see [Adding and Removing IAM Identity Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the *IAM User Guide*. **To use an IAM policy to deny SSH connections through Session Manager** + Use one of the following options: + **Option 1**: Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). In the navigation pane, choose **Policies**, and then update the permissions policy for the user or role to block from starting Session Manager sessions. For example, add the following element to the Quickstart policy you created in [Quickstart end user policies for Session Manager](getting-started-restrict-access-quickstart.md#restrict-access-quickstart-end-user). ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "ssm:StartSession", "Resource": "arn:aws:ssm:*:*:document/AWS-StartSSHSession" }, { "Effect": "Allow", "Action": "ssmmessages:OpenDataChannel", "Resource": "arn:aws:ssm:*:*:session/${aws:userid}-*" } ] } ``` ------ + **Option 2**: Attach an inline policy to a user policy by using the AWS Management Console, the AWS CLI, or the AWS API. Using the method of your choice, attach the policy statement in **Option 1** to the policy for an AWS user, group, or role. For information, see [Adding and Removing IAM Identity Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the *IAM User Guide*.