The usual way into a Linux server is SSH: a key file, and port 22 open to wherever you sit. Session Manager, part of Systems Manager (ssm), opens a shell through AWS's own channel instead. No key to lose, no inbound port, and every session in the account's records.

An agent on the instance connects out to Systems Manager and waits for sessions. It can do that only with the role from the last lesson: a profile whose role has AmazonSSMManagedInstanceCore.

Starting a session

aws ssm start-session --target $ID

Starting session with SessionId: admin-0a1b2c3d4e5f67890
sh-5.2$

The prompt changes: you are now on the instance. Without the profile, the answer is TargetNotConnected instead: the agent never registered.

Inside

The commands you type now run on the instance. This one shows who you are there:

whoami

ssm-user, an account with sudo. And this one, also typed inside the session, shows who aws is there:

aws sts get-caller-identity

"Arn": "arn:aws:sts::123456789012:assumed-role/ssm-role/i-0a1b2c3d4e5f67890"

Nobody configured any keys, yet aws works: the instance received its role's temporary credentials. Whatever the role allows, the machine can do.

Leaving

exit

The session ends and the CloudShell prompt comes back.