Systems Manager Session Manager: servers with no open ports

Start as usual and load the network:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Create the instance role and profile (keep these)

Paste this whole block:

@'
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" }] }
'@ | Set-Content ec2-trust.json
aws iam create-role --role-name saat-ec2-ssm-role --assume-role-policy-document file://ec2-trust.json --tags Key=course,Value=saatvedha-aws Key=lesson,Value=13 | Out-Null
aws iam attach-role-policy --role-name saat-ec2-ssm-role --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
aws iam create-instance-profile --instance-profile-name saat-ec2-ssm-profile | Out-Null
aws iam add-role-to-instance-profile --instance-profile-name saat-ec2-ssm-profile --role-name saat-ec2-ssm-role

2Create the endpoint security group (keep it)

Paste this whole block:

$epSg = aws ec2 create-security-group --group-name saat-endpoint-sg --description "HTTPS from saat-vpc to interface endpoints" --vpc-id $v.VpcId --tag-specifications 'ResourceType=security-group,Tags=[{Key=Name,Value=saat-endpoint-sg},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=13}]' --query GroupId --output text
aws ec2 authorize-security-group-ingress --group-id $epSg --protocol tcp --port 443 --cidr 10.20.0.0/16 | Out-Null
$v | Add-Member -NotePropertyName EndpointSg -NotePropertyValue $epSg -Force
$v | ConvertTo-Json | Set-Content C:\aws-lab\saat-vpc.json

3Create the three interface endpoints (the clock starts now)

Paste this whole block. The loop waits until all three are available, usually two to three minutes:

$eps = foreach ($svc in 'ssm','ssmmessages','ec2messages') {
  aws ec2 create-vpc-endpoint --vpc-id $v.VpcId --vpc-endpoint-type Interface --service-name "com.amazonaws.ap-south-1.$svc" --subnet-ids $v.PrivateA --security-group-ids $epSg --private-dns-enabled --tag-specifications "ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=saat-$svc-endpoint},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=13}]" --query VpcEndpoint.VpcEndpointId --output text
}
do { Start-Sleep 20; $states = aws ec2 describe-vpc-endpoints --vpc-endpoint-ids $eps --query "VpcEndpoints[].State" --output text } until (($states -split '\s+' | Where-Object { $_ -ne 'available' }).Count -eq 0)
$states

You should see this:

available       available       available

4Launch app01 in the private subnet, with no key and no public IP

Paste this whole block:

$ami = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
Start-Sleep 15
$id = aws ec2 run-instances --image-id $ami --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=app01},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=13},{Key=owner,Value=yourname.admin}]' --query "Instances[0].InstanceId" --output text
do { Start-Sleep 20; $ping = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$id" --query "InstanceInformationList[0].PingStatus" --output text } until ($ping -eq 'Online')
aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$id" --query "InstanceInformationList[0].[PingStatus,PlatformName,AgentVersion]" --output text

You should see something like this:

Online  Amazon Linux    3.3.2746.0

The Start-Sleep 15 gives IAM time to make the new instance profile visible to EC2. Without it, a launch right after creating the profile can fail with “Invalid IAM Instance Profile name”.

5Install the Session Manager plugin

Run this:

winget install --id Amazon.SessionManagerPlugin -e
$env:Path += ';C:\Program Files\Amazon\SessionManagerPlugin\bin'
session-manager-plugin

The last line should print:

The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.

Adding the folder to $env:Path saves you from opening a new window and losing your variables.

6Open a session

Run this, then type the commands after the sh prompt:

aws ssm start-session --target $id

Type this at the sh-5.2$ prompt:

whoami
curl -m 5 https://checkip.amazonaws.com
exit

You should see something like this:

Starting session with SessionId: yourname.admin-0a1b2c3d4e5f67890
sh-5.2$ whoami
ssm-user
sh-5.2$ curl -m 5 https://checkip.amazonaws.com
curl: (28) Connection timed out after 5001 milliseconds
sh-5.2$ exit

Exiting session with sessionId: yourname.admin-0a1b2c3d4e5f67890.

You have a shell on a server that can’t reach the internet, has no public IP and has no inbound rule for SSH. The session ID starts with your user name, and it appears in CloudTrail as StartSession.

✅ Checkpoint: app01 shows Online, the session opened as ssm-user, and curl to the internet failed, proving the path went through the endpoints. Keep app01 and the endpoints for the break lab.