AWS Session Manager session recording vs shellz

Instead of opening sessions in the AWS console, engineers can add a ProxyCommand line to their SSH config that sends SSH through Session Manager. Then ssh, scp, SFTP and VS Code Remote all work with port 22 closed.

AWS's logging docs say: "Logging isn't available for Session Manager sessions that connect through port forwarding or SSH." SSH encrypts the traffic inside the tunnel, so the SSM agent can only pass it along. CloudTrail shows that an engineer opened a tunnel at 14:03 UTC. Nothing shows what they did next.

EC2 Instance Connect, a WireGuard VPN and an emergency SSH key leave the same gap.

shellz records on the server, after SSH has decrypted the session. Tunnelled SSH, one-off remote commands, SFTP uploads, console logins, su - and docker exec are all recorded the same way. A login that tries to skip the recorder is killed and raises an alert. A CI bot or AI agent with an SSH key is recorded like a person.

For plain shell sessions, Session Manager can send commands and output to S3 or CloudWatch Logs. That's useful for searching and for triggering EventBridge rules.

Reconstructing an incident from that text is harder. Full-screen programs like vim and top come out as noise. AWS says Linux and macOS servers need screen installed, or the log may be cut short. Live streaming to CloudWatch doesn't support interactive commands. Typed secrets can end up in the log, so AWS suggests turning off terminal echo before typing them.

shellz saves a replay and a text transcript. You can watch live about a second behind, or replay at any speed. Password prompts such as sudo and passwd are never recorded.

A root user on an EC2 instance can stop the SSM agent, and its logging stops with it. On a shellz server, root changes to the recorder are undone within seconds. A server that goes quiet raises an alert within about a minute, and uninstalling needs approval in the dashboard.

On EC2 you pay only for S3 and CloudWatch Logs storage. Costs start when you add servers outside AWS or approval workflows.

• ›Servers outside AWS. Since September 30, 2026, each Session Manager session on an on-prem or other-cloud server costs $0.05. Registering those servers is free.
• ›Just-in-time (JIT) node access. This adds an approval step before someone can connect. It costs $0.0137 per server per hour. It's switched on for a whole AWS account, so every managed server is billed once the free trial ends.
• ›Windows RDP video. Included with JIT node access, but you have to set up an S3 bucket and a KMS encryption key with specific permissions.
• ›Example month: 50 EC2 instances, 20 on-prem Linux servers, five engineers and 400 sessions on the on-prem servers. JIT on the EC2 instances costs $500.05. The on-prem servers add $255.50 if they stay registered all month, plus $20 for sessions. shellz Commercial for the same five engineers on all 70 servers is $50 plus $1/GB stored.

If every server is on EC2, nobody tunnels SSH, and a locked text log in S3 meets your audit control, you don't need another tool. Session Manager removes open ports, bastion hosts and SSH key handling for free. It covers Windows Server and macOS, feeds CloudWatch and Security Lake, and is covered by AWS's compliance reports, including SOC 2, ISO 27001, PCI DSS and FedRAMP High. For Azure, see shellz vs Azure Bastion.

Keep Session Manager and IAM as the only way onto your instances. Engineers' SSH tunnel setups don't change. Each session is encrypted on the instance before upload. With Perfect Secrecy, the decryption key stays on your team's passkeys, so shellz can't read recordings (security design, pricing).

shellz has limits on AWS. It has no SIEM export or public API yet, runs only on systemd-based Linux, and is a newer vendor without its own SOC 2 report. See also the PAM vs session recording guide and Tailscale SSH recording alternatives.

• ›Install by adding one line to the instance's UserData script: curl -fsSL https://get.shellz.dev | sudo sh -s -- szt_...