AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
How do I use Session Manager to control access to my instances?
I want to control access to my instances so that users can start a session with Session Manager, a capability of AWS Systems Manager.
Short description
Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.
Use Session Manager to manage Amazon Elastic Compute Cloud (Amazon EC2) instances or on-premises instances. Session Manager connects through a browser-based shell, or through the AWS CLI.
Use Identity and Access Management (IAM) policies to control the users who can use Session Manager to access your instance. The IAM policy also controls the API actions that the users can perform.
Prerequisites:
- Complete the Session Manager prerequisites.
- Verify or create an IAM instance profile with Session Manager permissions.
Resolution
To allow users to connect to Session Manager, use the example JSON document at Example 2: Restrict access to specific managed nodes to create an IAM policy. The IAM policy that grants StartSession access to the IAM user you specify.
Note: The Amazon Resource Name (ARN) in the example policy uses the AWS Region us-east-1 and includes placeholders for the instance ID and account ID. Replace instance ID with your instance's ID number. Replace account ID with your AWS account.
Then, attach the IAM policy to the user that must connect to Session Manager.
Use the AWS CLI to connect to Session Manager
Prerequisite: Install the Session Manager plugin for the AWS CLI.
Run the following start-session command to connect to Session Manager:
aws ssm start-session --target instance-id
Note: Replace instance-id with the instance ID that the user wants to start a session.
Start a session with Amazon EC2
To allow a user to start a session with Amazon EC2 in the AWS Management Console, console, attach the following AWS managed policies to that user:
Related information
Additional sample IAM policies for Session Manager
AWS managed policies for AWS Systems Manager
How AWS Systems Manager works with IAM
Systems Manager IAM rolesAWS managed policies for AWS Systems Manager
- Topics
- Management & Governance
- Language
- English
This article has been reviewed and updated on 2026/03/24.
Relevant content
asked 2 years ago
asked a year ago
- AWS OFFICIALUpdated 4 months ago
