Amazon EC2 Instance Connect Specializedsince 2008
A service for securely connecting to EC2 instances without pre-distributing SSH keys
What It Does
Amazon EC2 Instance Connect lets you securely connect to EC2 instances without pre-distributing or managing SSH key pairs. It pushes a temporary SSH public key to the instance metadata, establishing a connection valid for only 60 seconds. Access is controlled through IAM policies, and connection logs are recorded in CloudTrail.
Use Cases
It is used when developers need to connect to EC2 instances for troubleshooting, or when you want to simplify SSH key management. Browser-based connections are also available, so you can connect even without a local SSH client.
Everyday Analogy
Think of it like a hotel key card system. When a guest (developer) verifies their identity at the front desk (IAM), a key card (temporary SSH key) valid only for their stay is issued. The key card becomes invalid after checkout, eliminating the risk of lost keys.
What Is EC2 Instance Connect?
EC2 Instance Connect is a service that balances SSH connection security with convenience. Traditional SSH connections required managing private key files, but Instance Connect automatically generates temporary keys based on IAM authentication. You can also open a terminal directly in your browser from the AWS Management Console.
Connection Methods
There are three connection methods: browser-based connection from the AWS Management Console, using the ec2-instance-connect command in the AWS CLI, and combining with a standard SSH client. In all cases, only users authorized by IAM policies can access instances, and connection events are recorded in CloudTrail.
Getting Started
Simply select an instance in the EC2 console and click the 'Connect' button. By creating an Instance Connect Endpoint in your VPC, you can connect to instances in private subnets without a public IP. You need to configure the security group to allow SSH from the Instance Connect IP range.
Things to Watch Out For
- Instance Connect is a Linux-only feature, covering Amazon Linux 2/2023, Ubuntu, and other distributions. It does not support SSH to Windows instances (as of August 2026; RDP connections to Windows are possible via an Instance Connect Endpoint)
- Connecting to instances in private subnets requires creating an Instance Connect Endpoint
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.
