How do I create Amazon VPC endpoints so that I can use Systems Manager to manage private Amazon EC2 instances without internet access?

Resolution

To manage EC2 instances without internet access, configure Systems Manager to use an Amazon Virtual Private Cloud (Amazon VPC) interface endpoint on AWS PrivateLink.

Create an IAM instance profile for Systems Manager

Complete the following steps:

1. Verify that AWS Systems Manager Agent (SSM Agent) is installed on the instance.
2. Create an AWS Identity and Access Management (IAM) instance profile. You can create a new role, or add the necessary permissions to an existing role.
3. Attach the IAM role to your instance.
4. Open the Amazon EC2 console, and then select your instance.
5. Choose the Description tab, and then note the VPC ID and Subnet ID.

Note: If you're using Default Host Management Configuration to manage your instances, then you don't need to create an IAM instance profile to manage instances.

Create or modify a security group

Create a security group, or modify an existing security group. Attach the security group to your instance. The security group must allow outbound traffic on port 443 to the VPC endpoints. Also, attach a security group to the VPC endpoint. The security group must allow inbound HTTPS (port 443) traffic from the resources in your VPC that communicate with the service. For more information, see Security group rules for different use cases.

Note: You can create one security group for the inbound and outbound rules and attach it to the instance and the VPC endpoint.

To configure the security group for the VPC endpoint, complete the following steps:

1. Open the Amazon VPC console.
2. Choose Security groups, and then select the new security group.
3. On the Inbound rules tab, choose Edit inbound rules.
4. Add a rule with the following details:
   For Type, choose HTTPS.
   For Source, select your VPC CIDR.
   For advanced configuration, you can allow the CIDR for specific subnets in the VPC or a security group that your instances use.
5. Note the security group ID to use with the other endpoints.
6. Choose Save rules.

Create and configure a VPC endpoint for Systems Manager

Note: VPC endpoints map to a specific subnet. If you select multiple subnets when you create the VPC endpoints, then one endpoint is created for each selected subnet. Your billing costs increase because you incur charges for each endpoint.

Complete the following steps:

1. Create a VPC endpoint.
2. For Service name, select com.amazonaws.[region].ssm. For a list of AWS Region codes, see Available Regions.
3. For VPC, choose the VPC ID for your instance.
4. For Subnets, choose a Subnet ID in your VPC.
   For High availability, choose at least two subnets from different Availability Zones within the same Region.
   Note: If you have more than one subnet in the same Availability Zone, then you don't need to create VPC endpoints for the extra subnets. Other subnets within the same Availability Zone can access and use the interface.
5. For Security group, select your security group.
6. (Optional) For an advanced setup, create an interface VPC endpoint policy for Systems Manager.
   Note: VPC endpoints require an AWS provided DNS (VPC CIDR+2). If you're using a custom DNS, then use Amazon Route 53 Resolver for the correct name resolution.
7. Repeat steps 2-6 with the following changes:
   For the Session Manager endpoint, select com.amazonaws.[region].ssmmessages for the service name.
   For EC2 Messages endpoint, select com.amazonaws.[region].ec2messages for the service name.
   Note: For SSM Agent versions 3.3.40.0 and later, Systems Manager uses the ssmmessages:* endpoint when available instead of the ec2messages:* endpoint. For more information, see the Endpoint connection precedence section in Agent-related API operations (ssmmessages and ec2messages endpoints).

To verify that your instance is registered as a managed instance, complete the following steps:

1. Open the Systems Manager console.
2. In the navigation pane, choose Fleet Manager.
3. Verify that your instance ID is listed under Node ID and the node is in the Running state.

Note: After you complete the configuration, it might take a few minutes for the instance to register as a managed instance. To have SSM Agent connect immediately, restart SSM Agent in the instance or restart the instance.

If you don't use the default session preferences, then create the following VPC endpoints to use Session Manager, a capability of AWS Systems Manager:

• If you use Amazon Simple Storage Service (Amazon S3) logging for Run Command, a capability of Systems Manager, then create the com.amazonaws.region.s3 gateway endpoint.
• If you use AWS Key Management Service (AWS KMS) encryption for Session Manager, then create the com.amazonaws.region.kms endpoint.
• If you use Amazon CloudWatch Logs for Run Command, then create a service endpoint for your Region.

The VPC endpoint isn't required to connect the instance to Session Manager. The VPC endpoint is required to create Windows Volume Shadow Copy Service (VSS)-based snapshots of the instance.

Related information

AWS Systems Manager endpoints and quotas

Setting up AWS Systems Manager