tabby-aws-ssm-ssh documentation

A Tabby terminal plugin that connects to EC2 instances through AWS Systems Manager (SSM) Session Manager — no public IP, no open inbound ports, and optionally no SSH key pair at all.

Two connection modes are supported:

• AWS SSM Session — opens a shell directly through the SSM Agent using only IAM permissions. No SSH key pair or sshd required on the instance.

• SSH over SSM — tunnels port 22 through SSM (AWS-StartSSHSession) and authenticates with a real SSH key pair, just like a normal SSH connection, but without the instance ever needing a public IP or an open security group inbound rule.

AWS credentials can come from a named AWS CLI profile, a static access key/secret, or a tabby-ssh-keepass entry — see Prerequisites and Usage for the full picture.

Contents:

• Prerequisites
  • Tabby itself
  • EC2 instance side
  • IAM permissions (client side)
  • SSH-over-SSM specific requirements
  • Optional: KeePass integration
• Installation
  • Method 1 — Install from the Tabby Plugin Manager
  • Method 2 — Clone the Git repository and build from source
  • Development workflow
• Usage
  • Creating a connection
  • Connection profile fields
  • Choosing a connection type
  • AWS credential options
  • SSH credential options (SSH-over-SSM mode only)
  • KeePass lookup
• Architecture
  • Component relationships
  • Key classes
  • End-to-end flow
• Troubleshooting & FAQ
  • “TargetNotConnected” / session fails to start
  • “AccessDeniedException” when starting a session
  • Connection hangs or times out on a private instance
  • SSH-over-SSM connects but authentication fails
  • KeePass entry not found / wrong credentials retrieved
  • AWS profile credentials aren’t picked up