DocsICP FilingConsole
Documentation
Home Page Elastic Compute Service User Guide Instances Connect to your instance Connect using Session Manager Enable session encryption

Enable session encryption for Session Manager

Updated at:
Copy as MD
Product
My Favorites

Enable Session Manager encryption to protect sensitive data with autonegotiated keys or Key Management Service (KMS) keys.

Encryption methods

Session Manager encrypts all session data with the AES-256-CBC algorithm. Alibaba Cloud cannot decrypt or view the content.

Two encryption methods are available:

Encryption mode

Description

Advantages

Scenarios

Autonegotiated key

The system negotiates a one-time session key between both parties. The key exists only in local memory. Alibaba Cloud does not store any key material.

No extra resources required. Ready to use out of the box.

General scenarios that need quick encryption without independent key management or auditing.

KMS key

Uses a customer master key (CMK) you create in KMS to generate a data encryption key and encrypt the session.

Full control over key lifecycle, rotation, and auditing. Meets stricter security and compliance requirements.

Strict security and compliance scenarios, such as finance and government, that require key control and auditing.

Prerequisites

Complete the following before you enable either encryption method:

  • Session Manager is enabled.

    How to enable

    1. Log on to the ECS console - Instances. Select a resource group and region at the top of the page.

    2. In the Actions column of the target instance, click Connect.

    3. Click Show Other Logon Methods. Find Session Manager, turn on the switch, and follow the on-screen instructions.

  • Cloud Assistant Agent is upgraded to one of the following versions or later:

    • Linux: 2.2.4.1005

    • Windows: 2.1.4.1005

Encrypt sessions with an autonegotiated key

This method requires no extra permissions or resources.

Procedure

  1. Log on to the ECS console - Instances. Select a resource group and region at the top of the page.

  2. Find the target instance and click Connect. Find Workbench and click Sign in now.

  3. On the Instance Login page, select Password-Free and configure:

    1. Turn on the Session Encryption switch.

    2. For Encryption Mode, select Auto-negotiated Key.

  4. Click Log In.

    The message This session is encrypted appears at the top of the terminal, confirming encryption is active.

Encrypt sessions with a KMS key

This method provides stronger security but requires a KMS key and related permissions.

Prerequisites

Procedure

  1. Log on to the ECS console - Instances. Select a resource group and region at the top of the page.

  2. Find the target instance and click Connect. Find Workbench and click Sign in now.

  3. On the Instance Login page, select Password-Free and configure:

    1. Turn on the Session Encryption switch.

    2. For Encryption Mode, select KMS Key and configure it.

  4. Click Log In.

    The message This session is encrypted appears at the top of the terminal, confirming encryption is active.

Access policy details

The following RAM policies are required for session encryption.

Permissions required for a RAM user to use a KMS key

To use the KMS key method, a RAM user needs the following permissions in addition to basic Session Manager permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:ListKeys",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "kms:GenerateDataKey",
      "Resource": "*"
    }
  ]
}

Permissions required for the instance RAM role

With the KMS key method, the Cloud Assistant Agent on the instance must assume a RAM role to decrypt the KMS-generated session key. Grant the following permissions to the instance RAM role:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "acs:kms:<region-id>:<account-id>:key/<cmk-id>"
    }
  ]
}
In Resource, <region-id> is the region ID of the KMS key, <account-id> is your Alibaba Cloud account ID, and <cmk-id> is the KMS customer master key ID.

FAQ

  • Is there a charge for the session encryption feature?

    Session Manager and its encryption feature are free.

    • Autonegotiated Key mode incurs no extra fees.

    • KMS key mode requires paying KMS fees.

  • Why can't I find the session encryption option in the logon dialog box?

    The Cloud Assistant Agent version is too old. Upgrade Cloud Assistant Agent to one of the following versions or later:

    • Linux: 2.2.4.1005

    • Windows: 2.1.4.1005

  • Why is the drop-down list empty when I select a KMS key?

    Check the following:

    • Region mismatch: The KMS key must be in the same region as the ECS instance. The drop-down list shows only keys in the same region.

    • Insufficient permissions: Verify that the RAM user has the kms:ListKeys permission. See Permissions required for a RAM user to use a KMS key.

    • No available keys: Verify that a KMS customer master key of the Symmetric Key type exists in the current region.

  • Why does the connection fail with the error message handleKeyExchangeError Error: KMS decrypt failed when I use the KMS key mode?

    Verify that the ECS instance has an instance RAM role attached with the required permissions.

  • What is the difference between session encryption and HTTPS/TLS encryption?

    HTTPS/TLS secures the transport layer between your browser and the Alibaba Cloud endpoint. Session Manager encryption is end-to-end: it covers the entire path from your browser to the target ECS instance, keeping data encrypted even on the Alibaba Cloud internal network.

Previous：Connect in the ECS consoleNext：Connect using Session Manager CLI