Windows Access via Session Manager, No RDP Port

Photo by Christina @ wocintechchat.com on Unsplash*

Session Manager, part of AWS Systems Manager, gives you controlled, secure shell access to a Windows or Linux instance without ever opening a port in the security group. Here's how to use it to reach a Windows box (including RDP) without 3389 open to the world.

What this walkthrough assumes

• A Windows instance in a public subnet, with RDP open for the initial setup
• The AWS CLI configured on your local machine

The shape of it

• Install the SSM Agent on the instance
• Attach the right IAM role so SSM has permission to manage it
• Console in through Session Manager and add a new user to the RDP group
• Install the Session Manager plugin locally, then port-forward RDP through it

Step 1: install the SSM Agent (over RDP, one last time)

Connect via RDP as usual: select the instance, click Connect, choose the RDP client, download the RDP file, and decrypt the password with your key file. Once you're in, open PowerShell and run the four commands to download and install the AmazonSSMAgent, register it on the system path, clean up the installer, and restart the service.

Step 2: attach the SSM role

On the instance, go to Actions → Security → Modify IAM Role, and attach the AWS-managed role AmazonSSMRoleForInstancesQuickSetup.

Confirm it worked: open Systems Manager → Session Manager, click Start Session, and your instance should show up as available.

Step 3: add a user to the RDP group, from inside Session Manager

In the Session Manager shell:

1. Store a password in a variable with Read-Host -AsSecureString
2. Create a new local user (e.g. Sai) with that password
3. Add that user to the Remote Desktop Users group

Step 4: port-forward RDP through Session Manager

Install the Session Manager plugin locally, and confirm it with session-manager-plugin in a new PowerShell window.

Start the forwarding session:

aws ssm start-session --target <instance-id> --document-name AWS-StartPortForwardingSession --parameters "localPortNumber=54231,portNumber=3389" --region <region>

Open Remote Desktop Connection locally, set the computer to localhost:54231, the username to Sai, connect, and enter the password.

Once that connects cleanly, remove port 3389 from the security group entirely. Access still works, just without the open port.

Worth reading alongside this

• AWS's SSM Agent installation docs
• The managed-instance setup guide
• The Session Manager plugin install docs
• AWS's own walkthrough video on Session Manager

Practical guide: if you want to try this yourself

A condensed, in-order checklist for getting Session Manager access to a Windows instance and closing off RDP.

1. Install the SSM Agent over RDP, one last time. Connect normally via the console's RDP client, then in PowerShell run the four commands to download and install the AmazonSSMAgent, register it on the system path, clean up the installer, and restart the service.
2. Attach the SSM IAM role. On the instance, go to Actions → Security → Modify IAM Role and attach the AWS-managed role AmazonSSMRoleForInstancesQuickSetup.
3. Confirm the instance shows up in Session Manager. Open Systems Manager → Session Manager, click Start Session, and check that your instance is listed as available.
4. Create a local user from inside the Session Manager shell. Store a password with Read-Host -AsSecureString, create a new local user (e.g. Sai) with it, and add that user to the Remote Desktop Users group.
5. Install the Session Manager plugin locally. Confirm it installed correctly by running session-manager-plugin in a new PowerShell window.
6. Start a port-forwarding session to tunnel RDP through Session Manager, using aws ssm start-session --target <instance-id> --document-name AWS-StartPortForwardingSession --parameters "localPortNumber=54231,portNumber=3389" --region <region>.
7. Connect with Remote Desktop Connection, pointing the computer field at localhost:54231, using the username you created and its password.
8. Once that connection works cleanly, remove port 3389 from the security group entirely. Access still works through the Session Manager tunnel, just without the open port.