aws-ssm-start-session-execute-command

ssm:StartSession opens an interactive WebSocket shell to a managed instance, bypassing firewall rules.

derived aws emits CanExecuteCommand

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`VirtualMachine`
source	`?principal`
target	`?instance`
permissions	`ssm:StartSession`
conditions	`service_state` `iam_permission`
state logic	ACTIVE when ssm:StartSession is EFFECTIVE on the instance ARN scope and the instance is Online. CONDITIONAL(service_state) when agent connectivity is uncertain. BLOCKED when an SCP / boundary denies ssm:StartSession. Note: Session Manager requires no inbound security-group rule — this edge is often ACTIVE even when SSH port 22 is closed.

source type

Identity

target type

VirtualMachine

source

?principal

target

?instance

permissions

ssm:StartSession

conditions

service_state iam_permission

state logic

ACTIVE when ssm:StartSession is EFFECTIVE on the instance ARN scope and the instance is Online. CONDITIONAL(service_state) when agent connectivity is uncertain. BLOCKED when an SCP / boundary denies ssm:StartSession. Note: Session Manager requires no inbound security-group rule — this edge is often ACTIVE even when SSH port 22 is closed.

Narrative

{principal.name} can open an interactive shell to {instance.name} via Session Manager (ssm:StartSession), bypassing any SSH/RDP firewall restrictions. The session executes as the SSM Agent user (root or SYSTEM).

Raw rule rules/derived/aws/ssm.yaml

id: aws-ssm-start-session-execute-command
emits: CanExecuteCommand
description: ssm:StartSession opens an interactive WebSocket shell to a managed instance, bypassing firewall
  rules.
match:
- - principal: null
  - HasPermission
  - instance: null
where:
- effective_action == 'ssm:StartSession'
- node_type(?instance) == VirtualMachine
- ?instance.ssm_ping_status == 'Online'
emit:
  source_type: Identity
  target_type: VirtualMachine
  source: ?principal
  target: ?instance
  permissions:
  - ssm:StartSession
  conditions:
  - service_state
  - iam_permission
  state_logic: "ACTIVE when ssm:StartSession is EFFECTIVE on the instance ARN scope and the instance is\
    \ Online. CONDITIONAL(service_state) when agent connectivity is uncertain. BLOCKED when an SCP / boundary\
    \ denies ssm:StartSession. Note: Session Manager requires no inbound security-group rule \u2014 this\
    \ edge is often ACTIVE even when SSH port 22 is closed."
  confidence: 0.95
  derived_from:
  - effective ssm:StartSession on ?instance
  false_positive_note: 'ssm:StartSession may be constrained by the ssm:SessionDocumentAccessCheck condition
    and document-level resource policy. Honor both. Session Manager requires the SSM Session Manager plugin
    on the caller''s local machine for AWS CLI-initiated sessions, but programmatic WebSocket access does
    not. The same service_state gate as SendCommand applies: agent must be Online.'
  narrative: '{principal.name} can open an interactive shell to {instance.name} via Session Manager (ssm:StartSession),
    bypassing any SSH/RDP firewall restrictions. The session executes as the SSM Agent user (root or SYSTEM).'