AWS Systems Manager Session Manager

aws Bastion hostaws-ssm-session-manager

Browser and CLI shell access to managed nodes over TLS with no inbound ports, bastion or public IP.

Provider: aws
Kind: Bastion host
Category: Security
Official docs: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

Properties · 4 set by this component

property	type	values	required	kind default	this component
inboundPortsRequired · component property	boolean	—	no	false	inherited
justInTimeAccess	boolean	—	no	false	inherited
managed	boolean	—	no	false	▸ true
mfaRequired	boolean	—	no	—	inherited
portForwarding · component property	boolean	—	no	true	inherited
protocols	enum	ssh \| rdp \| both	no	—	▸ both
publicIp	boolean	—	no	—	▸ false
sessionEncryption · component property	enum	tls-1-2 \| tls-1-2-plus-kms	no	tls-1-2	inherited
sessionLogDestination · component property	enum	none \| s3 \| cloudwatch-logs	no	none	inherited
sessionRecording	boolean	—	no	—	▸ false

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "ssm-session-manager", component: "aws-ssm-session-manager" }

Other Bastion host products · 17

Bastionhostalibaba-bastionhostalibabacloudbastion-host EC2 Instance Connect Endpointaws-ec2-instance-connect-endpointawsbastion-host AWS Verified Accessaws-verified-accessawsbastion-host Azure Bastionazure-bastionazurebastion-host Microsoft Entra Private Accessazure-entra-private-accessazurebastion-host Cloudflare Accesscloudflare-accesscloudflarebastion-host Cloudflare One RDPcloudflare-rdpcloudflarebastion-host Generic bastion hostbastion-hostbastion-host HashiCorp Boundaryboundarybastion-host ContainerSSHcontainersshbastion-host Paralusparalusbastion-host Pomeriumpomeriumbastion-host OpenSSH jump hostssh-jump-hostbastion-host Teleportteleportbastion-host Chrome Enterprise Premiumgoogle-chrome-enterprise-premiumgcpbastion-host Identity-Aware Proxygoogle-identity-aware-proxygcpbastion-host Bastionoci-bastionocibastion-host

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Systems Manager Session Manager: fully managed shell and port-forwarding access to managed nodes. Per
3# "AWS Systems Manager Session Manager" it needs no inbound ports, no bastion host and no public IP,
4# traffic is TLS 1.2, and logging session data to S3 or CloudWatch Logs is something you choose to enable.
5schemaVersion: "1"
6type: "component"
7id: "aws-ssm-session-manager"
8kind: "bastion-host"
9provider: "aws"
10docs: "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html"
11defaults:
12  protocols: "both"
13  sessionRecording: false
14  publicIp: false
15  managed: true
16properties:
17  inboundPortsRequired:
18    type: "boolean"
19    default: false
20  portForwarding:
21    type: "boolean"
22    default: true
23  sessionEncryption:
24    type: "enum"
25    values: ["tls-1-2", "tls-1-2-plus-kms"]
26    default: "tls-1-2"
27  sessionLogDestination:
28    type: "enum"
29    values: ["none", "s3", "cloudwatch-logs"]
30    default: "none"

The same page as markdown, for an agent: /catalogue/components/aws-ssm-session-manager.md