<p>There're many ways to access its EC2 instances as we know and if you want let the users access the instance <strong>only through AWS Console</strong>, then you might want to use AWS SSM (System manager), which will allow the user access only the authorised EC2 instances without Bstion host by the given IAM policy.</p>
<p>Here's instruction that you can consider as below:</p>
<ol>
<li><p>Install and verify its SSM agent on the Windows or Linux instance. See <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-install-win.html" rel="nofollow noreferrer">Manually install SSM Agent on EC2 instances for Windows Server
</a></p>
</li>
<li><p>Set a given IAM policy belong to the users or group.
Refer to <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-restrict-access-examples.html" rel="nofollow noreferrer">Additional sample IAM policies for Session Manager</a>.</p>
</li>
</ol>
<ul>
<li>You can either restrict access based on instance tags or specific instances-id, Just pick one that you want to.</li>
</ul>
<p>An example of user IAM policy as following:</p>
<pre><code>{
    &quot;Sid&quot;: &quot;ssmpolicy&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: &quot;ssm:StartSession&quot;,
    &quot;Resource&quot;: &quot;arn:aws:ec2:eu-west-1:xxxxxxxxx:instance/*&quot;,
    &quot;Condition&quot;: {
        &quot;StringLike&quot;: {
            &quot;ssm:resourceTag/Name&quot;: [
                 &quot;Instance_app_1&quot;,
                 &quot;Instance_app_2&quot;
            ]
         }
     }
}
</code></pre>
<ol start="3">
<li>Lastly, set EC2 IAM Role for the instance with <code>AmazonSSMManagedInstanceCore</code> managed policy by AWS.</li>
</ol>
<p>Then you're good to go safely. Connecting its Windows instance on AWS Console is pretty easy. Please take a look by visitng <a href="https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/connecting_to_windows_instance.html#session-manager" rel="nofollow noreferrer">Connect to a Windows instance using Session Manager
</a></p>
<p>When a user access the EC2 via AWS console, a prompt will be appears like in the picture, and then can access if IAM Role and policy has been given properly in each instance and the users.</p>
<p><a href="https://i.sstatic.net/FZyQR.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FZyQR.png" alt="enter image description here" /></a></p>

CC BY-SA 4.0
2021-09-12T10:27:58.177Z
2021-09-12T10:45:49.057Z
2021-09-12T10:45:49.057Z
Chachatonel Hashimotto
<p>You can define security groups in AWS. later you can attach these security groups to instances.</p>
<p>REFERENCE :
<a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html</a></p>

CC BY-SA 4.0
2021-09-12T10:00:37.580Z
2021-09-12T10:00:37.580Z
SRJ
<p>I'm planning to use AWS EC2 instances for the development purpose of my web application. So, I will like to disable all the outbound ports except RDP(3389) port. The RDP port will only be open to a particular AWS Service(host). Users can access the host only after logging into AWS Console.</p>
<p>Can anyone please help me understand if there is any service in AWS that can be used as the host?</p>
<p>For reference, Azure has a Bastion Host, which can be used for this purpose.</p>

<amazon-web-services><amazon-ec2>
AWS EC2: RDP without exposing instance to public
Yash
# AWS EC2: RDP without exposing instance to public

(Asked by: username_0 on 2021-09-12)

I'm planning to use AWS EC2 instances for the development purpose of my web application. So, I will like to disable all the outbound ports except RDP(3389) port. The RDP port will only be open to a particular AWS Service(host). Users can access the host only after logging into AWS Console.

Can anyone please help me understand if there is any service in AWS that can be used as the host?

For reference, Azure has a Bastion Host, which can be used for this purpose.

**Tags:** amazon-web-services, amazon-ec2


---

## 2 answers

### Answer by username_1 on 2021-09-12. Score: 2 | Accepted answer

There're many ways to access its EC2 instances as we know and if you want let the users access the instance only through AWS Console, then you might want to use AWS SSM (System manager), which will allow the user access only the authorised EC2 instances without Bstion host by the given IAM policy.
Here's instruction that you can consider as below:

Install and verify its SSM agent on the Windows or Linux instance. See Manually install SSM Agent on EC2 instances for Windows Server


Set a given IAM policy belong to the users or group.
Refer to Additional sample IAM policies for Session Manager.



You can either restrict access based on instance tags or specific instances-id, Just pick one that you want to.

An example of user IAM policy as following:
{
    "Sid": "ssmpolicy",
    "Effect": "Allow",
    "Action": "ssm:StartSession",
    "Resource": "arn:aws:ec2:eu-west-1:xxxxxxxxx:instance/*",
    "Condition": {
        "StringLike": {
            "ssm:resourceTag/Name": [
                 "Instance_app_1",
                 "Instance_app_2"
            ]
         }
     }
}


Lastly, set EC2 IAM Role for the instance with AmazonSSMManagedInstanceCore managed policy by AWS.

Then you're good to go safely. Connecting its Windows instance on AWS Console is pretty easy. Please take a look by visitng Connect to a Windows instance using Session Manager

When a user access the EC2 via AWS console, a prompt will be appears like in the picture, and then can access if IAM Role and policy has been given properly in each instance and the users.


---

### Answer by username_2 on 2021-09-12. Score: 1

You can define security groups in AWS. later you can attach these security groups to instances.

REFERENCE :
<https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html>


---

