title: AWS Session Manager can't connect unless opening SSH port
body: <p>I'm trying to use AWS Systems Manager Session Manager to connect to my EC2 instances.</p>
  <p>These are private EC2 instances, without public IP, sitting on a private subnet in a VPC with Internet access through a NAT Gateway.</p>
  <p>Network ACLs are fully opened (both inbound and outbound), but there's no Security Group that allows SSH access into the instances.</p>
  <p>I went through all the Session Manager <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html" rel="nofollow noreferrer">prerequisites</a> (SSM agent, Amazon Linux 2 AMI), however, when I try to connect to an instance through the AWS Console I get a red warning sign saying: &quot;<em>We weren’t able to connect to your instance. Common reasons for this include</em>&quot;.</p>
  <p>Then, if I add a Security Group to the instance that allows SSH access (inbound port 22) and wait a few seconds, repeat the same connection procedure and the red warning doesn't come up, and I can connect to the instance.</p>
  <p>Even though I know these instances are safe (they don't have public IP and are located in a private subnet), opening the SSH port to them is not a requirement I would expect from Session Manager. In fact, the official documentation says that one of its benefits is: &quot;<em>No open inbound ports and no need to manage bastion hosts or SSH keys</em>&quot;.</p>
  <p>I searched for related posts but couldn't find anything specific. Any ideas what I might be missing?</p>
  <p>Thanks!</p>