EC2 Bastion with SSM Fallback

Secure Bastion That Doesn't Need Port 22 Open

Traditional bastions require an open port 22 and careful key management. This CloudFormation stack deploys a hardened bastion with SSM Session Manager as the primary access method — no inbound rules required, full session logging, and IAM controls who can connect.

What's Included

• EC2 bastion with SSM Agent and required IAM instance profile
• Security group with zero inbound rules (SSH via SSM only)
• Optional port 22 toggle for legacy access during transition
• Session logs streamed to CloudWatch Logs with 90-day retention
• IAM policy document for granting team member access
• Auto-patching via SSM Patch Manager baseline

Connecting

aws ssm start-session --target i-0abc123def456

No SSH key distribution. No VPN requirement. Access controlled entirely through IAM.

Included Files

• bastion.yaml — CloudFormation template
• iam-policies/bastion-access.json — IAM policy for session access
• README.md — SSM setup requirements and access guide