--- title: Connect Using EC2 Instance Connect via Teleport | daily.dev description: A note at the top flags that this feature is now obsolete, superseded by Teleport's auto-discovery for AWS EC2. The original content explains how Teleport... canonical: https://daily.dev/posts/connect-using-ec2-instance-connect-via-teleport-isvzvw1sl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Connect Using EC2 Instance Connect via Teleport | daily.dev og:description: A note at the top flags that this feature is now obsolete, superseded by Teleport's auto-discovery for AWS EC2. The original content explains how Teleport... og:url: https://daily.dev/posts/connect-using-ec2-instance-connect-via-teleport-isvzvw1sl og:image: https://api.daily.dev/og/posts/IsVzvw1Sl.png og:image:alt: Connect Using EC2 Instance Connect via Teleport og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connect Using EC2 Instance Connect via Teleport **[Teleport](https://daily.dev/sources/teleport)** · 5 min read · 0 upvotes · 0 comments ## Summary A note at the top flags that this feature is now obsolete, superseded by Teleport's auto-discovery for AWS EC2. The original content explains how Teleport integrated with AWS EC2 Instance Connect Endpoint (EICE), a feature Amazon introduced to allow SSH access to private EC2 instances without needing a bastion host or public IP. It walks through the mechanics: Teleport generates a short-lived SSH key pair, sends the public key via the SendSSHPublicKey API action, opens a websocket tunnel to the EICE service, and authenticates using the AuthorizedKeysCommand mechanism on the instance. It also covers the setup flow for enrolling and accessing EC2 instances through Teleport's wizard, including required security group rules and IAM permissions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the Teleport EC2 Instance Connect Endpoint feature still the recommended way to access EC2 instances? No, this feature is obsolete. Teleport now recommends using its Auto-Discovery feature for streamlined enrollment of AWS EC2 instances instead of the manual EC2 Instance Connect Endpoint integration described in earlier documentation. _Track how tools like Teleport evolve their AWS integrations by following infrastructure access updates on daily.dev._ ### How does AWS EC2 Instance Connect Endpoint (EICE) let you SSH into a private EC2 instance without a bastion host? EICE lets you connect to EC2 instances behind a private subnet using IAM policies instead of maintaining a bastion host. A client sends a temporary SSH public key via the ec2-instance-connect:SendSSHPublicKey action, valid for 60 seconds, then opens a websocket tunnel to the endpoint requiring ec2-instance-connect:OpenTunnel permission, streaming the TCP connection to the instance's SSH server. _Engineers weighing bastion hosts versus IAM-based access can compare approaches like this on daily.dev._ ### What package or config is required on an EC2 instance for AWS Instance Connect Endpoint to work? The instance needs the aws-ec2-instance-connect-config package installed, which configures the OpenSSH daemon's AuthorizedKeysCommand to run a script fetching authorized SSH public keys from the AWS Instance Metadata Service. This tool comes preinstalled on Ubuntu 20.04+, Amazon Linux 2023, and Amazon Linux 2 2.0.20190618+ AMIs. _Developers configuring secure EC2 access can find similar AWS setup details on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [AWS Transfer Family SFTP connectors now support VPC-based connectivity](https://daily.dev/posts/aws-transfer-family-sftp-connectors-now-support-vpc-based-connectivity-7ptxcduk7) · AWS · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#ssh](https://daily.dev/tags/ssh), [#aws-ec2](https://daily.dev/tags/aws-ec2), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/connect-using-ec2-instance-connect-via-teleport-isvzvw1sl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Connect Using EC2 Instance Connect via Teleport","url":"https://daily.dev/posts/connect-using-ec2-instance-connect-via-teleport-isvzvw1sl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/connect-using-ec2-instance-connect-via-teleport-isvzvw1sl"},"datePublished":"2026-08-23T12:21:51.731Z","dateModified":"2026-08-23T12:43:39.472Z","description":"A note at the top flags that this feature is now obsolete, superseded by Teleport's auto-discovery for AWS EC2. The original content explains how Teleport...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/connect-using-ec2-instance-connect-via-teleport-isvzvw1sl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,ssh,aws-ec2,iam","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Connect Using EC2 Instance Connect via Teleport"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/connect-using-ec2-instance-connect-via-teleport-isvzvw1sl#faq","mainEntity":[{"@type":"Question","name":"Is the Teleport EC2 Instance Connect Endpoint feature still the recommended way to access EC2 instances?","acceptedAnswer":{"@type":"Answer","text":"No, this feature is obsolete. Teleport now recommends using its Auto-Discovery feature for streamlined enrollment of AWS EC2 instances instead of the manual EC2 Instance Connect Endpoint integration described in earlier documentation. Track how tools like Teleport evolve their AWS integrations by following infrastructure access updates on daily.dev."}},{"@type":"Question","name":"How does AWS EC2 Instance Connect Endpoint (EICE) let you SSH into a private EC2 instance without a bastion host?","acceptedAnswer":{"@type":"Answer","text":"EICE lets you connect to EC2 instances behind a private subnet using IAM policies instead of maintaining a bastion host. A client sends a temporary SSH public key via the ec2-instance-connect:SendSSHPublicKey action, valid for 60 seconds, then opens a websocket tunnel to the endpoint requiring ec2-instance-connect:OpenTunnel permission, streaming the TCP connection to the instance's SSH server. Engineers weighing bastion hosts versus IAM-based access can compare approaches like this on daily.dev."}},{"@type":"Question","name":"What package or config is required on an EC2 instance for AWS Instance Connect Endpoint to work?","acceptedAnswer":{"@type":"Answer","text":"The instance needs the aws-ec2-instance-connect-config package installed, which configures the OpenSSH daemon's AuthorizedKeysCommand to run a script fetching authorized SSH public keys from the AWS Instance Metadata Service. This tool comes preinstalled on Ubuntu 20.04+, Amazon Linux 2023, and Amazon Linux 2 2.0.20190618+ AMIs. Developers configuring secure EC2 access can find similar AWS setup details on daily.dev."}}]} ```