Administrator Guide¶

Prepare the AWS path StormTunnel uses to reach private databases and internal services.

Setup Guides¶

• AWS configuration — SSM-managed EC2 instances, IAM, network access, and verification.
• AWS IAM policies — Separate permissions for StormTunnel users and EC2 instances.
• Monitoring and logging — SSH server logging and audit options.
• SSH server setup — For environments that still require SSH.

AWS Connectivity Checklist¶

• EC2 instance is registered as a Systems Manager managed node.
• The instance has Systems Manager permissions and outbound connectivity to SSM.
• The instance can resolve and reach the private destination host and port.
• The destination security group allows traffic from the EC2 instance's security group.
• StormTunnel users have permission to start the required Session Manager document and end their sessions.
• The user's Mac has AWS CLI v2 and the Session Manager plugin installed.

AWS Session Manager removes the need for inbound SSH access to the EC2 instance. It does not remove the need to control access to the database or internal service.