Day 18 of #CloudSecurity: AWS Systems Manager
Kill your bastion hosts. SSM Session Manager routes shell sessions over HTTPS through the SSM agent -- no port 22 needed.
Critical security config most skip:
```json
{"runAsEnabled": true, "runAsDefaultUser": "ssm-user", "kmsKeyId": "your-key-arn"}
```
Without runAsEnabled, every session runs as root. Without KMS, sessions lack end-to-end encryption beyond TLS.
Also: explicitly deny port forwarding documents in IAM.…
