VM security & operations · AWS vs Google Cloud
AWS Systems Manager Session Manager / EC2 Instance Connect Endpoint vs Identity-Aware Proxy TCP forwarding / OS Login
Session Manager and EC2 Instance Connect Endpoint map to Identity-Aware Proxy TCP forwarding (SSH and RDP without external IPs) combined with OS Login (IAM-managed SSH access).
Side-by-side comparison
| Aspect | Amazon Web Services | Google Cloud |
|---|---|---|
| Service | AWS Systems Manager Session Manager EC2 Instance Connect Endpoint | Identity-Aware Proxy TCP forwarding OS Login |
| Lifecycle | Generally available Generally available | Generally available Generally available |
| What it is | Browser or CLI shell access and port forwarding to managed nodes through the SSM Agent, with no open inbound ports, bastion hosts, or SSH keys. Sessions are logged and IAM-controlled. A VPC endpoint for SSH or RDP to instances that have no public IP address, authorized with IAM. | Tunnels SSH, RDP, and other TCP traffic to VMs through IAP after an IAM check, so VMs don't need external IP addresses. Manages Linux SSH access to VMs with IAM roles instead of per-instance SSH keys. |
| Pricing model | Session Manager is free for EC2 (advanced-tier on-premises instances are billed). EC2 Instance Connect Endpoint is free, apart from cross-AZ data transfer. | IAP is offered at no charge (networking charges can apply). OS Login has no separate charge. |
| Docs | AWS Systems Manager Session Manager docs EC2 Instance Connect Endpoint docs | Identity-Aware Proxy TCP forwarding docs OS Login docs |
| Pricing page | AWS Systems Manager Session Manager pricing EC2 Instance Connect Endpoint pricing | Identity-Aware Proxy TCP forwarding pricing |
Key differences
- IAP tunnels raw TCP after an IAM check; there is no agent-based shell like Session Manager.
- OS Login ties Linux accounts to Google identities and IAM roles instead of per-instance keys.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Session Manager is free for EC2 (advanced-tier on-premises instances are billed). EC2 Instance Connect Endpoint is free, apart from cross-AZ data transfer. AWS Systems Manager Session Manager pricing → EC2 Instance Connect Endpoint pricing →
- GCP
- IAP is offered at no charge (networking charges can apply). OS Login has no separate charge. Identity-Aware Proxy TCP forwarding pricing →
And on Azure?
Partial match Azure's equivalent is Azure Bastion. AWS vs Azure comparison →
FAQ
What is the Google Cloud equivalent of AWS Systems Manager Session Manager and EC2 Instance Connect Endpoint?
Session Manager and EC2 Instance Connect Endpoint map to Identity-Aware Proxy TCP forwarding (SSH and RDP without external IPs) combined with OS Login (IAM-managed SSH access).
How does pricing compare between AWS Systems Manager Session Manager and EC2 Instance Connect Endpoint and Identity-Aware Proxy TCP forwarding and OS Login?
AWS: Session Manager is free for EC2 (advanced-tier on-premises instances are billed). EC2 Instance Connect Endpoint is free, apart from cross-AZ data transfer. Google Cloud: IAP is offered at no charge (networking charges can apply). OS Login has no separate charge. Check the official pricing pages for current rates.
What is the Azure equivalent?
Azure Bastion (partial match). AWS Systems Manager Session Manager and EC2 Instance Connect Endpoint map to Azure Bastion.