Amazon-ssm-agent: Question - What are the port requirements?

[wayneworkman]

Hello,

What are the inbound and outbound port requirements for this?
Is there a list of IP addresses that the agent communicates with?

Thanks,
Wayne

[tj-corrigan]

I had the same question and did some quick testing. I believe that your instance will need egress on 443 to the the IPs for AMAZON service in your appropriate region. You can find these at https://ip-ranges.amazonaws.com/ip-ranges.json (see documentation at https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html). I believe they do change periodically but I can't say how frequently.

[mmendonca3]

Thank you for the response tj-corrigan. I will be closing this issue. In case there are any other related question, you can reopen this issue.

[dxciberaws]

It get's pretty crazy to manage egress SG rules and use AWS agents (SSM, CloudWatch, etc.). With 96 IP ranges in us-east-2, it first needs a limit increase, and then either manually maintaining a SG with all of them, or developing a custom automation... How much would it take for AWS to provide a managed SG in each region?

[MatteoMori]

Hey guys,

I feel I might be doing something stupid here. I have deployed an Amazon Linux 2 instance (therefore with the SSM agent running on it) and try to use AWS System Manager to SSH into it.

If I have full UDP open in my security group all works fine. If I remove that rule, I cannot create the session anymore.

I am not sure if I am misunderstanding but I thought that having 443 open in outbound would be enough.

Could you please let me know if I am doing something stupid?

kind regards,
Matteo

[abijr]

For anyone else looking: you need egress ports 443 and 80 on 0.0.0.0/0 with tcp.