Eliminate SSH Key Management with EC2 Instance Connect - Secure Connections from Browser and CLI
This article explains keyless SSH connections with EC2 Instance Connect, IAM-based access control, and how to use the Endpoint.
Overview of EC2 Instance Connect
EC2 Instance Connect is a service that connects securely to EC2 instances without distributing SSH keys in advance. With conventional SSH connections, creating, distributing, and rotating key pairs and handling lost keys was an operational burden, but Instance Connect uses temporary public keys and makes key management unnecessary.
Endpoint and Private Connectivity
EC2 Instance Connect Endpoint is an endpoint that you create inside a VPC, and it lets you connect to instances in private subnets without a public IP or a bastion server. You control the ec2-instance-connect:OpenTunnel action with IAM policies to restrict connections to specific instances and subnets. At connection time, a temporary SSH public key is placed in the instance metadata for 60 seconds, so no persistent key remains on the instance.
EC2 Instance Connect Endpoint
With EC2 Instance Connect Endpoint (EIC Endpoint), you can make SSH/RDP connections to instances in private subnets without a public IP address or a bastion server. You create an EIC Endpoint inside the VPC and use IAM policies to control the users allowed to connect and the target instances. Because connections are tunneled through AWS PrivateLink, there is no need to open the inbound SSH port in the instance's security group. With CloudTrail, you can audit who connected to which instance and when, and SSH key management is also unnecessary. A single EIC Endpoint lets you connect to instances in multiple subnets within the VPC, and no additional charges apply.
Comparing and Choosing Connection Methods
There are three methods of connecting to EC2: EC2 Instance Connect, Systems Manager Session Manager, and conventional SSH key pairs. Instance Connect injects a temporary public key through the metadata service, so managing persistent SSH keys is unnecessary. Session Manager is agent-based and does not use the SSH protocol, so you can connect without opening inbound ports. Conventional SSH key pairs can be used with your existing workflows as they are, and the users operate key rotation and distribution themselves. Which method to use in which environment is decided by the audit requirements and whether you can open ports.
EC2 Instance Connect Pricing
EC2 Instance Connect is available free of charge. No additional charges apply for SSH connections from the browser, connections from the CLI, or use of Instance Connect Endpoint. Session Manager (Systems Manager) connections can be used at no additional charge. With Instance Connect Endpoint, you can connect to instances in private subnets that have no public IP address without placing a NAT Gateway or a bastion server.
Prerequisites and Supported Environments
EC2 Instance Connect is available on supported operating systems and in supported Regions. The standard Amazon Linux and Ubuntu AMIs include the required package in advance, so you can use it without additional configuration. On other distributions, you install the package for accepting connections manually. Because IAM permissions are evaluated at connection time, you allow the required actions for the users' roles in advance. Because the mechanism injects a temporary public key through the metadata for only a short time, there is no need to distribute keys to the instance side in advance. Before adoption, you check these prerequisites.
Best Practices for Security Design
You design access control in detail with IAM policies. You narrow down the actions that allow connections to target instances, tags, or subnets, and define who can connect where with least privilege. When you use Instance Connect Endpoint, you control traffic with the endpoint's security group and avoid opening inbound ports on the instance side. Because connection records remain in CloudTrail, you can audit who entered which instance and when. With this method, you do not handle key distribution and revocation, and instead you center operations on permission design and log auditing.
Using It in Operations and Combining It with Other Methods
Because EC2 Instance Connect lets you connect from the browser or the command line, you can use it in development and investigation scenarios. On the other hand, for routine operational work or requirements where inbound ports cannot be opened, you can use Systems Manager Session Manager. The two are not mutually exclusive, and you can use them together according to the purpose. For example, one approach is to consolidate day-to-day operations in Session Manager while using Instance Connect for specific investigations. If you prepare multiple means as alternative connection paths for emergencies, you can connect to the instance when one of them is unavailable.
Summary
EC2 Instance Connect is a service that makes SSH key management unnecessary and provides IAM-based access control. With EIC Endpoint, you can connect to instances in private subnets without a public IP or a bastion server, and CloudTrail records audit logs of connections. By using it alongside Session Manager as appropriate, you can choose the connection method that fits the purpose.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.