Shell Access with No Bastion, and a Transcript

aws-ssm-session-manager

Shell access to an instance with no inbound port, no SSH key and no bastion - and the logging that makes it auditable rather than merely convenient. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

The default is an unrecorded shell. Session Manager works with no configuration at all, and in that state nothing anywhere records what was typed: CloudTrail has StartSession and StopSession, not the commands. So the interesting part of this module is not the access, which is free - it is the session document that turns logging on, and the precondition that refuses to build one without a destination unless accept_unlogged_sessions says you meant it.

The document name is not cosmetic. Session Manager reads account preferences from a document called exactly SSM-SessionManagerRunShell. A document with any other name is a document nobody reads, and everything in it is settings that look applied and are not. The name is fixed in the module for that reason.

Encryption has two independent switches, and confusing them is how transcripts end up in the clear:

• kms_key_arn encrypts the session - the keystrokes in flight, beyond the TLS already there
• encrypt_logs encrypts the transcript at its destination

Setting a log destination and leaving encrypt_logs false writes the transcript in plain text, which a precondition refuses unless accept_plaintext_logs says the bucket's own encryption is handling it.

Two more things it gets right:

• AmazonSSMManagedInstanceCore does not grant the permissions to write the session log. An instance with only that policy connects fine and silently produces no transcript - the failure that looks like success. The module adds the S3, CloudWatch and KMS permissions scoped to the destinations you gave it
• The operator policy is scoped by instance tag and to this document. ssm:StartSession on "*" is administrator access to the whole estate through a door that leaves no key behind

run_as_user is offered because ssm-user is created by the agent and added to sudoers, so every operator's actions resolve to the same OS account.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.