Home / AWS / Fix AWS EC2 Systems Manager SSM Not Connected

AWS

Fix AWS EC2 Systems Manager SSM Not Connected

Resolve SSM Session Manager connection issues by fixing IAM roles, VPC endpoints, SSM agent status, and network connectivity.

Published: Apr 1, 20266 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

AWS Systems Manager Session Manager provides secure shell access to EC2 instances without opening SSH ports. When an instance shows as "not connected" in the SSM console, you can't start sessions, run commands, or manage the instance through SSM.

Symptoms

In the AWS Console:

bash

Instance status: Connection lost
The instance is not connected to Session Manager.

Via AWS CLI:

```bash $ aws ssm describe-instance-information --filters Key=InstanceIds,Values=i-abc123

{ "InstanceInformationList": [] } ```

When trying to start session:

bash

TargetNotConnected: i-abc123 is not connected to the Session Manager.

Common Causes

1.SSM agent not running - Agent stopped or crashed on the instance
2.Missing IAM role - Instance doesn't have an IAM instance profile
3.IAM permissions incorrect - Role lacks required SSM permissions
4.No internet access - Private instance without VPC endpoints
5.VPC endpoints missing - Required endpoints not configured
6.SSM agent version outdated - Very old agent version
7.Proxy misconfiguration - Agent can't reach SSM endpoints through proxy
8.Security group restrictions - Outbound traffic blocked

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check Instance IAM Role

bash

aws ec2 describe-instances --instance-ids i-abc123 \
  --query 'Reservations[*].Instances[*].IamInstanceProfile.Arn'

If empty, attach an IAM role:

```bash # Create instance profile if needed aws iam create-instance-profile --instance-profile-name SSM-Instance-Profile

# Attach role to instance profile aws iam add-role-to-instance-profile \ --instance-profile-name SSM-Instance-Profile \ --role-name SSM-Instance-Role

# Attach to instance aws ec2 associate-iam-instance-profile \ --instance-id i-abc123 \ --iam-instance-profile Name=SSM-Instance-Profile ```

Step 2: Verify IAM Role Permissions

The IAM role needs these permissions:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:UpdateInstanceInformation",
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::aws-ssm-region/*",
        "arn:aws:s3:::aws-windows-downloads-region/*",
        "arn:aws:s3:::amazon-ssm-region/*"
      ]
    }
  ]
}

Use AWS managed policy AmazonSSMManagedInstanceCore:

bash

aws iam attach-role-policy \
  --role-name SSM-Instance-Role \
  --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

Step 3: Check SSM Agent Status

If you can SSH into the instance:

```bash # Amazon Linux 2 / RHEL / CentOS sudo systemctl status amazon-ssm-agent sudo systemctl restart amazon-ssm-agent

# Ubuntu sudo systemctl status snap.amazon-ssm-agent.amazon-ssm-agent.service sudo snap restart amazon-ssm-agent

# Check agent logs tail -f /var/log/amazon/ssm/amazon-ssm-agent.log ```

If agent is not installed:

```bash # Amazon Linux 2 sudo yum install -y amazon-ssm-agent sudo systemctl enable amazon-ssm-agent sudo systemctl start amazon-ssm-agent

# Ubuntu sudo snap install amazon-ssm-agent sudo snap start amazon-ssm-agent ```

Step 4: Verify Network Connectivity

Test if instance can reach SSM endpoints:

```bash # On the instance, test connectivity curl -v https://ssm.us-east-1.amazonaws.com curl -v https://ssmmessages.us-east-1.amazonaws.com

# Check DNS resolution nslookup ssm.us-east-1.amazonaws.com ```

If instance is in private subnet without internet gateway:

bash

# Check if VPC endpoints exist
aws ec2 describe-vpc-endpoints \
  --filters Name=vpc-id,Values=vpc-12345 Name=service-name,Values=com.amazonaws.us-east-1.ssm

Step 5: Create VPC Endpoints for Private Subnets

```bash # Get VPC ID and subnet IDs VPC_ID=vpc-12345 SUBNETS="subnet-1 subnet-2" SG=sg-12345

# Create SSM endpoint aws ec2 create-vpc-endpoint \ --vpc-id $VPC_ID \ --vpc-endpoint-type Interface \ --service-name com.amazonaws.us-east-1.ssm \ --subnet-ids $SUBNETS \ --security-group-ids $SG

# Create SSM Messages endpoint (for Session Manager) aws ec2 create-vpc-endpoint \ --vpc-id $VPC_ID \ --vpc-endpoint-type Interface \ --service-name com.amazonaws.us-east-1.ssmmessages \ --subnet-ids $SUBNETS \ --security-group-ids $SG

# Create EC2 Messages endpoint (for Run Command) aws ec2 create-vpc-endpoint \ --vpc-id $VPC_ID \ --vpc-endpoint-type Interface \ --service-name com.amazonaws.us-east-1.ec2messages \ --subnet-ids $SUBNETS \ --security-group-ids $SG ```

Step 6: Check Security Group Rules

The instance security group must allow outbound HTTPS (443):

```bash # Check outbound rules aws ec2 describe-security-groups --group-ids sg-12345 \ --query 'SecurityGroups[*].IpPermissionsEgress'

# Add outbound rule if missing aws ec2 authorize-security-group-egress \ --group-id sg-12345 \ --protocol tcp \ --port 443 \ --cidr 0.0.0.0/0 ```

For VPC endpoints, the endpoint security group must allow inbound HTTPS from the instance security group.

Step 7: Update SSM Agent

If agent is old:

```bash # Amazon Linux 2 sudo yum update amazon-ssm-agent -y sudo systemctl restart amazon-ssm-agent

# Ubuntu sudo snap refresh amazon-ssm-agent

# Verify version sudo amazon-ssm-agent -version ```

Step 8: Check Agent Registration

bash

# On the instance
cat /var/lib/amazon/ssm/registration

If missing or corrupted, re-register:

```bash # Stop agent sudo systemctl stop amazon-ssm-agent

# Remove registration sudo rm -f /var/lib/amazon/ssm/registration

# Start agent (auto-registers) sudo systemctl start amazon-ssm-agent

# Check registration sudo cat /var/lib/amazon/ssm/registration ```

Step 9: Verify Instance Appears in SSM

bash

aws ssm describe-instance-information \
  --filters Key=InstanceIds,Values=i-abc123 \
  --query 'InstanceInformationList[*].[InstanceId,PingStatus,LastPingDateTime]'

Should show PingStatus: Online with recent timestamp.

Step 10: Test Session Manager

```bash # Start session aws ssm start-session --target i-abc123

# Should open interactive shell ```

Verification

```bash # Check instance connection status aws ssm describe-instance-information \ --filters Key=InstanceIds,Values=i-abc123 \ --query 'InstanceInformationList[*].PingStatus'

# Should return: "Online"

# Test Run Command aws ssm send-command \ --instance-ids i-abc123 \ --document-name AWS-RunShellScript \ --parameters 'commands=["echo Hello from SSM"]' \ --query 'Command.CommandId' ```

[Fix AWS EC2 Instance Not Responding](/articles/fix-aws-ec2-instance-not-responding)
[Fix AWS SSM Command Failed](/articles/fix-aws-ssm-command-failed)
[Fix AWS EC2 Instance Connect Not Working](/articles/fix-aws-ec2-instance-connect-not-working)

[AWS troubleshooting: Fix IAM Permission Denied - Complete Tro](fix-iam-permission-denied)
[AWS cloud troubleshooting: AWS ACM Certificate Pending Validation Because the](aws-acm-certificate-pending-validation-wrong-route53-zone)
[AWS cloud troubleshooting: AWS ALB Returns 502 Because the Target Closed the ](aws-alb-502-target-closed-connection-keepalive-timeout-mismatch)
[AWS cloud troubleshooting: Fix AWS ALB CreateListener TargetGroupNotFound Err](aws-alb-createlistener-targetgroupnotfound)
[AWS cloud troubleshooting: Fix Aws Alb Lambda 502 Bad Gateway Issue in AWS](aws-alb-lambda-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

AWS EC2 Systems Manager SSM Not Connected AWS EC2 Systems Manager SSM Not Connected AWS AWS EC2 Systems Manager SSM Not Connected troubleshooting AWS EC2 Systems Manager SSM Not Connected fix Resolve SSM Session Manager connection issues by fixing IAM roles, VPC endpoints, SSM agent status, and network connectivity AWS Resolve SSM Session Manager connection issues by fixing IAM roles, VPC endpoints, SSM agent status, and network connectivity

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

AWS Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this aws-errors troubleshooting guide applies to my situation?

This guide is designed for aws-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these aws-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of aws-errors issue?

Most aws-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this aws-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for aws-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 1, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix AWS EC2 Systems Manager SSM Not Connected

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Instance IAM Role

Step 2: Verify IAM Role Permissions

Step 3: Check SSM Agent Status

Step 4: Verify Network Connectivity

Step 5: Create VPC Endpoints for Private Subnets

Step 6: Check Security Group Rules

Step 7: Update SSM Agent

Step 8: Check Agent Registration

Step 9: Verify Instance Appears in SSM

Step 10: Test Session Manager

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix AWS EC2 Systems Manager SSM Not Connected

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Instance IAM Role

Step 2: Verify IAM Role Permissions

Step 3: Check SSM Agent Status

Step 4: Verify Network Connectivity

Step 5: Create VPC Endpoints for Private Subnets

Step 6: Check Security Group Rules

Step 7: Update SSM Agent

Step 8: Check Agent Registration

Step 9: Verify Instance Appears in SSM

Step 10: Test Session Manager

Verification

Related Issues

Related Articles

People also search for

Share this guide

More AWS Troubleshooting Guides

Browse Guides from Other Categories

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading