DevOps AgentDocs
Start free

Servers

Servers over AWS Session Manager (SSM)

Open EC2 instances with no PEM and no open port 22, through AWS Systems Manager.

If your EC2 instances run the SSM agent, the panel can open them through AWS Session Manager instead of a saved PEM. Nothing changes once a server is open: the terminal, file manager, Docker, health checks, the Activity log and the AI assistant all work the same.

  • No inbound port 22. The SSM agent on the server connects out to AWS on port 443; the security group can have no inbound rules at all.
  • No stored keys. For every login the panel makes a one-time key pair in memory and hands AWS the public half for 60 seconds (EC2 Instance Connect).
  • Access is your IAM policy. Every session start and key push is an AWS API call, recorded in your CloudTrail.

SSM is available on self-hosted installs. It needs AWS's Session Manager plugin on the panel host, which the self-hosted image includes.

How servers get it

  1. Refresh reads which instances the SSM agent manages, along with your EC2 list. Their cards show SSM once access is on.
  2. An instance whose agent is Online and that has no saved PEM is switched on by itself while your plan has room for another server. There's nothing to set up: open it, or ask the AI assistant about it.
  3. If the plan is full, or you switched it off, the card shows Set up access. That dialog has Connect via SSM next to the PEM form.

A saved PEM always wins: an instance with one keeps connecting over SSH. To move it to SSM, remove its saved login.

Login user

The panel logs in as the image's default user, picked from the OS the agent reports: ubuntu for Ubuntu, admin for Debian, ec2-user for Amazon Linux, Red Hat and SUSE. If your servers use another account, change it under Set up access (the key icon on the card). Commands run through sudo when that user has passwordless sudo, as with SSH.

Switching it off

The unplug icon on the card (or Turn off SSM in the EC2 details) stops the panel opening that server: no Open, no health checks, and the AI assistant no longer lists it. A switched-off server doesn't count against your plan. Turn it back on from Set up access.

What the server needs

  • The SSM agent running. It is preinstalled on Amazon Linux, Ubuntu and most AWS images.
  • An instance profile with the AmazonSSMManagedInstanceCore policy (or Default Host Management Configuration turned on for the account).
  • Outbound HTTPS to the SSM endpoints, or VPC endpoints for ssm, ssmmessages and ec2messages on a private subnet.
  • sshd running, even though port 22 is closed to the network: the session reaches it on the server's own localhost.
  • EC2 Instance Connect, preinstalled on Amazon Linux 2 and 2023 and Ubuntu 20.04 and later. Without it, the panel writes the one-time key into the user's authorized_keys with a 20-minute expiry through SSM Run Command (needs OpenSSH 8.2 or later).

What the project's AWS access needs

{
  "Effect": "Allow",
  "Action": [
    "ssm:DescribeInstanceInformation",
    "ssm:StartSession",
    "ssm:TerminateSession",
    "ec2-instance-connect:SendSSHPublicKey",
    "ssm:SendCommand",
    "ssm:GetCommandInvocation"
  ],
  "Resource": "*"
}

ssm:SendCommand and ssm:GetCommandInvocation are only used for images without EC2 Instance Connect. You can narrow ssm:StartSession to your instances and the AWS-StartPortForwardingSession document.

When it won't connect

MessageWhat to check
The SSM agent on this server is offlineThe instance is running, its role has AmazonSSMManagedInstanceCore, and it can reach the SSM endpoints.
…can't open SSM sessions (missing …)Add the named action to the project's IAM policy, above.
The server refused the SSM login as "…"The login user doesn't exist on the server; change it under Set up access.
The Session Manager plugin isn't installedThe panel host is missing session-manager-plugin; use the self-hosted image.

See also