EC2 Instance Unreachable via SSM Session Manager
Summary This runbook resolves the situation where an EC2 instance is running and visible in the console but either does not appear in the Systems Manager Fleet Manager inventory, or returns a connection error when you attempt to start a Session Manager session. When to Use This Runbook Use this runbook when you observe any of the following: Session Manager shows "Instance not connected" or…
This runbook guides how to troubleshoot when an EC2 instance shows up in the console but does not connect via Session Manager. If a Session Manager connection attempt fails, or the instance does not appear in the Systems Manager Fleet Manager, run through the steps below.
First, confirm the EC2 instance itself is functioning properly. Check the instance state in the EC2 dashboard and ensure the status checks are passing. If not, resolve the instance issues before attempting Session Manager.
Next, verify the instance appears correctly in the Systems Manager Fleet Manager. Search for the instance ID in the Fleet Manager. If it does not show up, or marks as Connection Lost, the issue may stem from a missing IAM role, stopped SSM agent, or a network block. Proceed to the next steps.
Make sure the instance has an IAM role attached that includes the AmazonSSMManagedInstanceCore managed policy, or a policy with equivalent minimum SSM permissions. If the role is missing, attach it and allow a few minutes for the changes to take effect before rechecking.
Open the system logs on the instance to check the SSM agent. If the agent is running and logging normally, the instance is ready to connect. If not, you can restart the agent via Run Command, but only if the instance registration is already working. For fully unreachable instances, manual restart through EC2 Instance Connect or the serial console may be necessary.
Next, verify the instance can reach the required AWS endpoints used by Session Manager. The instance needs outbound HTTPS (port 443) access to three endpoints relevant to SSM: ssm.{region}.amazonaws.com for registration, ssmmessages.{region}.amazonaws.com for session data, and ec2messages.{region}.amazonaws.com for EC2 message delivery. For private instances with no NAT, VPC endpoints must be set up. Ensure the security group attached to the instance allows outbound HTTPS traffic to these endpoints.
If outbound HTTPS access is correctly enabled on the security group, but the instance still does not register, the SSM agent registration process may be expired. This can happen after actions like AMI snapshots or cloning the instance. Force a new registration by stopping the SSM agent, deleting the registration directory, and restarting the agent using EC2 Run Command.
Finally, once all checks pass and the instance appears in Fleet Manager and Session Manager can connect, you have resolved the issue. No destructive changes were made in this process.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
