VM security & operations
AWS Systems Manager Session Manager / EC2 Instance Connect Endpoint vs Azure Bastion
AWS Systems Manager Session Manager and EC2 Instance Connect Endpoint map to Azure Bastion.
Bastion is a managed RDP/SSH gateway, while Session Manager is agent-based shell access through the Systems Manager service.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Systems Manager Session Manager EC2 Instance Connect Endpoint | Azure Bastion |
| Lifecycle | Generally available Generally available | Generally available |
| What it is | Browser or CLI shell access and port forwarding to managed nodes through the SSM Agent, with no open inbound ports, bastion hosts, or SSH keys. Sessions are logged and IAM-controlled. A VPC endpoint for SSH or RDP to instances that have no public IP address, authorized with IAM. | A managed jump service for RDP and SSH to VMs over TLS from the portal or a native client, with no public IPs on the VMs. Available SKUs are Developer (free, shared), Basic, Standard, and Premium (session recording, private-only). |
| Pricing model | Session Manager is free for EC2 (advanced-tier on-premises instances are billed). EC2 Instance Connect Endpoint is free, apart from cross-AZ data transfer. | Billed hourly per Bastion SKU and scale unit, plus outbound data. The Developer SKU is free. |
| Docs | AWS Systems Manager Session Manager docs EC2 Instance Connect Endpoint docs | Azure Bastion docs |
| Pricing page | AWS Systems Manager Session Manager pricing EC2 Instance Connect Endpoint pricing | Azure Bastion pricing |
| Exams | SOA-C03 SCS-C03 | AZ-104 AZ-700 SC-500 |
Key differences
- How it works. Session Manager uses the SSM Agent's outbound connection, with no inbound ports and IAM-controlled, logged sessions. EC2 Instance Connect Endpoint is a VPC endpoint that proxies SSH or RDP to private IPs. Bastion is a managed service in your VNet (or shared, for the Developer SKU) that brokers RDP and SSH over TLS.
- Logging. Session Manager can log session content to CloudWatch Logs or S3. Bastion Premium offers graphical session recording.
- Azure Run Command and serial console cover the "run a script without logging in" case (like SSM Run Command).
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Session Manager is free for EC2 (advanced-tier on-premises instances are billed). EC2 Instance Connect Endpoint is free, apart from cross-AZ data transfer. AWS Systems Manager Session Manager pricing → EC2 Instance Connect Endpoint pricing →
- Azure
- Billed hourly per Bastion SKU and scale unit, plus outbound data. The Developer SKU is free. Azure Bastion pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified CloudOps Engineer – Associate SOA-C03 | AWS | Associate | current Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Systems Manager Session Manager and EC2 Instance Connect Endpoint?
AWS Systems Manager Session Manager and EC2 Instance Connect Endpoint map to Azure Bastion. Bastion is a managed RDP/SSH gateway, while Session Manager is agent-based shell access through the Systems Manager service.
How does pricing compare between AWS Systems Manager Session Manager and EC2 Instance Connect Endpoint and Azure Bastion?
AWS: Session Manager is free for EC2 (advanced-tier on-premises instances are billed). EC2 Instance Connect Endpoint is free, apart from cross-AZ data transfer. Azure: Billed hourly per Bastion SKU and scale unit, plus outbound data. The Developer SKU is free. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified CloudOps Engineer – Associate (SOA-C03); AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Network Engineer Associate (AZ-700); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).