Private EC2 Administration with AWS Systems Manager

Problem

I wanted to manage private EC2 instances without assigning public IP addresses or opening inbound SSH to the internet.

Implementation

I attached the required IAM role to the instances and configured the SSM, EC2Messages, and SSMMessages interface endpoints inside the VPC. This allowed Session Manager to reach private instances through AWS private connectivity.

Troubleshooting

When the instances were not initially available in Systems Manager, I traced the problem to missing private connectivity and added the required VPC endpoints.

What this demonstrates

Private EC2 management, IAM roles, VPC endpoint design, reduced administrative exposure, and practical AWS troubleshooting.