Connect to an instance by using Session Manager in the console-Alibaba Cloud Security Guide-阿里云帮助中心

Use Session Manager in the console to connect to your Elastic Compute Service (ECS) instances with a single click. Session Manager allows password-free logon to instances, including those without a public IP address, and provides a secure and convenient alternative to traditional SSH or Remote Desktop Protocol (RDP) connections. This topic describes how to connect to an instance by using Session Manager in the Alibaba Cloud console.

Important

Session Manager provides only command-line access to both Windows and Linux instances.

To connect to a Windows instance with a graphical user interface (GUI), use the port forwarding feature to map the instance's remote access port to your local machine and connect by using an RDP tool. For more information, see Use port forwarding in the Session Manager CLI to access an instance without a public IP address.

Prerequisites

The target instance is in the Running state

You can check the instance status on the Instances page of the ECS console. An instance in the Running state is shown in the following figure:

For instructions on how to check the status of an instance, see View instance information.

The Cloud Assistant Agent is installed on the instance

Session Manager relies on Cloud Assistant, which requires the Cloud Assistant Agent to be installed on your instance. You can check the agent's status in the Cloud Assistant section of the ECS console. An instance with the Cloud Assistant Agent installed is shown in the following figure:

ECS instances created from public images after December 1, 2017, have the Cloud Assistant Agent pre-installed by default. If your instance was created before this date or uses a custom image, you must manually install the Cloud Assistant Agent. For more information, see Install the Cloud Assistant Agent.

For information about how to check the status of the Cloud Assistant Agent and handle anomalies, see Check status and handle anomalies.

Ensure network connectivity (configure a security group)

When you use Session Manager to connect to an ECS instance, make sure that Cloud Assistant Agent running on the ECS instance is connected to the Cloud Assistant server by adding the following rules to an outbound security group:

Compared with connection methods, such as SSH and Remote Desktop Protocol (RDP), Cloud Assistant Agent actively establishes a WebSocket connection to the Session Manager server. You need to only open the outbound WebSocket port of the Cloud Assistant server in a security rule. For information about how Session Manager works, see the How Session Manager works section of this topic.

Important

If you use basic security groups including the default security group, all outbound traffic is allowed. No additional configuration is required.
If you use an advanced security group, all outbound traffic is denied. You must configure the relevant rules. The following table describes the rules. For information about security groups, see Basic and advanced security groups.

For information about how to add rules to a security group, see Add a security group rule.

Action	Priority	Protocol type	Port range	Authorization object	Description
Allow	1	Custom TCP	443	`100.100.0.0/16`	This port is used to access the Cloud Assistant server.
Allow	1	Custom TCP	443	`100.0.0.0/8`	This port is used to access the server on which the Cloud Assistant Agent installation package is stored when you want to install or update Cloud Assistant Agent.
Allow	1	Custom UDP	53	`0.0.0.0/0`	This port is used to resolve domain names.

If you want to connect to an instance by using only Session Manager, delete the inbound rules that allow the SSH port (default 22) and RDP port (default 3389) from a security group to improve the security of the ECS instance.

RAM users must have the required permissions

If a RAM user wants to use Session Manager to connect to an instance in the ECS console, the RAM user must be granted the following permissions based on the principle of least privilege:

ecs:StartTerminalSession: The permission to connect to an instance by using Session Manager. You can configure the Resource parameter to specify the ECS instances to which a RAM user can connect by using Session Manager.
ecs:DescribeCloudAssistantStatus: The permission to query whether Cloud Assistant Agent needs to be installed on an ECS instance. The system checks this permission before you connect to an instance in the ECS console.
ecs:DescribeUserBusinessBehavior: The permission to query whether Session Manager is enabled. The system checks this permission before you connect to an instance in the ECS console.
(Optional) ecs:ModifyCloudAssistantSettings: The permission to enable or disable Session Manager. If Session Manager is enabled for the current Alibaba Cloud account, you do not need to grant this permission.

Sample custom policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ecs:StartTerminalSession",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeUserBusinessBehavior",
        "ecs:DescribeCloudAssistantStatus",
        "ecs:ModifyCloudAssistantSettings"
      ],
      "Resource": "*"
    }
  ]
}

For information about how to grant permissions to a RAM user, see Grant permissions to a RAM user.

Procedure

Go to ECS console - InstancesECS console - Instances.
In the top navigation bar, select the region and resource group for your instance.
Click the ID of the target instance to go to its details page. Then, click Connect.
Click Show Other Logon Methods. In the Session Manager section, ensure that Session management turned on (full region) is displayed. If you see Session Management closed, turn on the switch to enable the feature.

Important
Before you enable Session Manager, make sure the RAM user has the ecs:DescribeUserBusinessBehavior permission to view the Session Manager configuration and the ecs:ModifyCloudAssistantSettings permission to enable or disable it. For a sample permission policy, see Prerequisites.
Click Secret-free login.

After a successful connection, you are logged on as ecs-assist-user for Linux instances or as system for Windows instances. The following figure shows a successful connection to a Linux instance.

Prerequisites

Procedure

Related reading