Connect to EC2 without managing SSH keys

EC2 Instance Connect pushes a freshly generated public key to the instance moments before connecting. AWS discards it after about a minute. Nothing is stored on your phone, so there is no key to lose, back up or rotate.

Two ways to sign in to AWS

Choose between zero-secret browser authentication and scoped IAM keys:

• Browser Login (AWS Console): Sign in via your browser with your root or IAM user account. The app performs an OAuth 2.0 PKCE exchange with DPoP token binding to obtain short-lived STS session credentials. No long-lived access keys are ever created or stored on your device.
• Access Keys: Enter an IAM Access Key ID and Secret Access Key for a tightly scoped IAM user.

Both modes support manual callback URL entry if you are running on an emulator or a remote device where local loopback redirects cannot be caught automatically.

How a connection goes

1. The app verifies your AWS credentials (or uses short-lived STS session tokens).
2. It generates an ephemeral keypair in memory.
3. It calls SendSSHPublicKey, which places the public half on the instance for roughly sixty seconds.
4. It connects over SSH and authenticates with the private half.
5. Both halves are discarded when the session ends.

The key is generated inside the connection attempt rather than when you tap the host, because the sixty-second window is short enough that anything else risks spending it on setup.

Multiple AWS profiles

Each set of credentials is a named profile (letters, digits, ., _, -). Settings > AWS lists them, each with its account, sign-in method and sign-in state; rename one, switch it between browser sign-in and access keys, or move the default. Each host picks its profile by name in the host editor, which can also start a new profile without leaving it. A stored sign-in that AWS refuses is renewed and retried automatically; only then are you asked to sign in again, in plain words.

Instance IDs, not addresses

You identify the host by its instance ID. The address is looked up at connect time, because an EC2 public address changes whenever an instance stops and starts without an Elastic IP — a stored one goes stale silently and the failure looks like a network problem. You can still enter a hostname to override the lookup, for a private address or a DNS name.

Region

An instance lives in one region, and one account usually has instances in several, so the region is set on the host. Under Region in the host editor, leave Same as account to use the account's default region, or pick the instance's own. The default is set on the AWS profile as Default region. If a connection says the instance was not found, the region is the first thing to check.

Session Manager: no open port

For an instance with no inbound access, set Connect using to Session Manager on the host. The app starts an AWS Systems Manager session to the instance's SSH port and carries the SSH connection over it, so your phone never connects to the instance directly and the security group needs no inbound rule. Login still uses the same one-time key as Instance Connect, so nothing is stored on the phone, and the SSH session runs over the Session Manager channel instead of a direct connection.

The instance needs the SSM Agent running, an instance profile that allows Systems Manager (AmazonSSMManagedInstanceCore), and the EC2 Instance Connect package, which is how the one-time key is delivered. Your AWS credentials need ssm:StartSession in addition to the three permissions below. Setup details.

Permissions it needs

Three actions for Instance Connect, and the app is designed so you can scope an IAM user tightly:

sts:GetCallerIdentity
ec2:DescribeInstances
ec2-instance-connect:SendSSHPublicKey

None of these can change, stop or read the contents of an instance. Setup guide, with ready-made IAM policies and browser sign-in steps.

Usernames

Selecting AWS prefills ec2-user, which is correct for Amazon Linux — what the EC2 launch wizard selects by default — and for RHEL, Fedora and SUSE. Ubuntu images want ubuntu and Debian wants admin, so the field stays editable and says so. A wrong username on Instance Connect produces a bare "Permission denied" that never mentions the username, which is a miserable thing to debug.

What it does not do

Instance Connect still needs port 22 reachable from your phone. If your instances are in a private subnet with no inbound access, choose Session Manager for that host, or use a tunnelling mode.

This mode is Pro. It's zero-secret and safer than a stored key, but it's still a cloud provider's protocol, engineered and maintained against AWS's own API — the free tier stays on Direct connections, jump hosts and Tailscale, which aren't.