c2.13 Manage EC2 without open SSH/RDP ports
Use AWS Systems Manager Session Manager and Fleet Manager to administer instances instead of opening SSH or RDP. You avoid inbound ports entirely, get MFA and command auditing, and reach Windows RDP through the console — all at no additional cost.
Implementation guidance
Close the administration ports
Open inbound SSH (22) and RDP (3389) ports are a favorite target for brute-force attacks. Instead of bastions or third-party tunnels, use AWS Systems Manager Session Manager: the SSM agent opens an outbound connection, so you can remove inbound administration ports from your security groups entirely.
Session Manager and Fleet Manager
- Session Manager gives you a shell on Linux or a PowerShell session on Windows without SSH.
- Fleet Manager manages instances without logging in (view processes, transfer files) and provides one-click Remote Desktop to Windows instances, authenticated through IAM Identity Center, OS credentials, or key pairs.
Both support MFA (via IAM Identity Center or the IAM user) and can log every command for audit.
Setup
Fleet Manager and Session Manager are free features of Systems Manager, but require the SSM agent (preinstalled on many AMIs), an instance profile with the <code>AmazonSSMManagedInstanceCore</code> managed policy, and network access to the SSM endpoints (via a NAT gateway or, preferably, VPC endpoints).
Start a session with the CLI
Open a shell on an instance with no inbound ports (requires the Session Manager plugin for the AWS CLI):
aws ssm start-session --target i-0123456789abcdef0How to validate
- Is the SSM agent installed, and on what percentage of your EC2 instances?
- Are your teams using Session Manager / Fleet Manager rather than SSH/RDP?
- Have you removed inbound administration ports from your security groups?
Threats addressed
- Unrestricted inbound access to administration ports (22, 3389) invites SSH/RDP brute-force attacks, and hosts on those ports are often unpatched — a successful login or exploit hands an adversary direct access.
AWS services
AWS Systems Manager Pricing
AWS Systems Manager Session Manager and Fleet Manager have no additional cost.