FDE Times: AWS Session Manager — reach client servers without opening port 22
A 6 November FDE Times tools guide covers Systems Manager Session Manager for FDEs blocked on closed SSH: IAM decides access, no bastion or inbound 22, but SSH/SCP tunnels are not content-logged — say so before sign-off and use interactive shell + S3/CloudWatch logging when the client needs every command.
FDE Times’s 6 November tools piece answers the week-one standoff: you need logs on a box, security will not open port 22 or stand up a bastion. AWS Session Manager (Systems Manager) closes inbound SSH/PowerShell, drops bastions and keys, and lets the client’s IAM policy decide who can reach which instances — including time-limited on-call grants.
You can keep ssh/scp habits via a ProxyCommand that calls aws ssm start-session with AWS-StartSSHSession, and use port forwarding for internal DBs or UIs without public exposure. Bring a narrow draft StartSession policy scoped to one instance so security can review exactly what you can touch.
The audit trap: AWS docs say port-forwarding and SSH tunnel sessions are not content-logged. CloudTrail still records who opened which session when; for command-level audit use the interactive shell with logs to S3 or CloudWatch, and say plainly that a tunnel is not an audit trail before the client signs off.
Source: fdetimes.net