The traditional way into a Linux server is SSH with a key file and port 22 open. AWS has a better door. Session Manager, part of Systems Manager (SSM), opens a shell through AWS's own channel: no key to lose, no inbound port, and every session in the audit trail.

What the instance needs

An agent on the instance connects outward to Systems Manager and waits for sessions. To do that it needs permission, and permission for a machine means a role (Chapter 2) delivered through an instance profile.

aws iam create-role --role-name ssm-role --assume-role-policy-document file://ec2-trust.json
aws iam attach-role-policy --role-name ssm-role --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
aws iam create-instance-profile --instance-profile-name ssm-profile
aws iam add-role-to-instance-profile --instance-profile-name ssm-profile --role-name ssm-role

The trust policy names the EC2 service as the principal:

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" }] }

AmazonSSMManagedInstanceCore is the AWS managed policy with exactly what the agent needs. Then attach the profile to a running instance, or pass --iam-instance-profile Name=ssm-profile at launch:

aws ec2 associate-iam-instance-profile --instance-id i-… --iam-instance-profile Name=ssm-profile
aws ssm describe-instance-information --query "InstanceInformationList[].[InstanceId,PingStatus]" --output text

When the instance appears as Online, the agent has checked in.

Starting a session

aws ssm start-session --target i-0a1b2c3d4e5f67890

Starting session with SessionId: admin-0a1b2c3d4e5f67890
sh-5.2$ whoami
ssm-user
sh-5.2$ sudo systemctl status httpd
sh-5.2$ exit

You are ssm-user on the instance, with sudo. exit ends the session. Without a profile the command fails with TargetNotConnected, which is the agent saying it never registered.

The machine's own identity

sh-5.2$ aws sts get-caller-identity

"Arn": "arn:aws:sts::123456789012:assumed-role/ssm-role/i-0a1b2c3d4e5f67890"

Inside, aws has credentials without anyone configuring them: the instance fetches temporary credentials for its role from the metadata service. Whatever the role allows, the machine can do. That is how an instance reads from S3 or writes logs later in the course, with no key stored on disk.