SSH Manager Pro

Connect to EC2 without managing SSH keys

EC2 Instance Connect pushes a freshly generated public key to the instance moments before connecting. AWS discards it after about a minute. Nothing is stored on your phone, so there is no key to lose, back up or rotate.

How a connection goes

  1. The app generates a keypair in memory.
  2. It calls SendSSHPublicKey, which places the public half on the instance for roughly sixty seconds.
  3. It connects over SSH and authenticates with the private half.
  4. Both halves are discarded when the session ends.

The key is generated inside the connection attempt rather than when you tap the host, because the sixty-second window is short enough that anything else risks spending it on setup.

Instance IDs, not addresses

You identify the host by its instance ID. The address is looked up at connect time, because an EC2 public address changes whenever an instance stops and starts without an Elastic IP — a stored one goes stale silently and the failure looks like a network problem. You can still enter a hostname to override the lookup, for a private address or a DNS name.

Permissions it needs

Three actions, and the app is designed so you can scope an IAM user tightly:

sts:GetCallerIdentity
ec2:DescribeInstances
ec2-instance-connect:SendSSHPublicKey

None of these can change, stop or read the contents of an instance. Setup guide, with a ready-made IAM policy.

Usernames

Selecting AWS prefills ec2-user, which is correct for Amazon Linux — what the EC2 launch wizard selects by default — and for RHEL, Fedora and SUSE. Ubuntu images want ubuntu and Debian wants admin, so the field stays editable and says so. A wrong username on Instance Connect produces a bare "Permission denied" that never mentions the username, which is a miserable thing to debug.

What it does not do

Instance Connect still needs port 22 reachable from your phone. If your instances are in a private subnet with no inbound access, use a tunnelling mode instead — or Session Manager, which is on the roadmap.

This mode is free. It replaces stored private keys with something safer, and charging for the more secure option would be the wrong incentive.