Overview
SSRR (Secure Server Start & Resource Reporter) gives organizations a safe, auditable way for remote users to control EC2 servers without AWS IAM access. Built for teams that connect via VPN, AWS WorkSpaces, or bastion hosts, SSRR enables key-based authentication, granular power control, detailed activity logs, and cost visibility-all from inside your AWS environment. Users log in with standard SSH keys, then start, stop, or restart approved EC2 instances through a simple interface. Every action is recorded with timestamps and usernames for full accountability, and administrators can export these logs to Amazon CloudWatch or S3 for compliance review. Integrated runtime and billing metrics reveal per-instance costs, helping teams reduce idle-time expenses and manage budgets effectively. Because SSRR runs entirely within your VPC and Users require no IAM credentials, it minimizes the security surface area while maintaining fine-grained control. Deployment takes minutes: launch the preconfigured AMI, assign EC2 permissions, and your team can immediately begin managing instances safely. Ideal for development environments, research labs, training platforms, and any organization that wants to empower remote users to manage compute resources securely while keeping visibility, control, and compliance front and center.
Highlights
- Key-based access only. Users authenticate with SSH keys. no IAM users or AWS console required.
- Start & stop EC2 servers. Simple, self-service interface for securely powering instances on or off.
- Full audit logging. Tracks every action with user, time, and instance details. exportable to CloudWatch.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Vendor refund policy
no refund
Custom pricing options
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
updated images - all region now supported auto install
Additional details
Usage instructions
Launch the SSRR AMI into your VPC from AWS Marketplace. Select a subnet reachable from your VPN, AWS WorkSpaces, or internal network. Assign or create an IAM role named ssrr_role with: Managed policies: AmazonEC2FullAccess AmazonSSMManagedInstanceCore Inline policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant" ], "Resource": "arn:aws:kms:eu-west-1:<AccountID>:key/<KeyID>" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:FilterLogEvents" ], "Resource": [ "arn:aws:logs:eu-west-1:<AccountID>:log-group:SSRR:" ] }, { "Effect": "Allow", "Action": ["workspaces:DescribeWorkspaces"], "Resource": "" } ] } Configure the instance s security group: Inbound: Allow HTTP (80) from your internal network or VPN range so users can reach the web interface. (Optional) Allow SSH (22) for administrators if console access is needed. to log in the server run the following command from your cmd Terminal: ssh -i <ypur-key>.pem ec2-user@<your-en2-public-ip> Outbound: Allow traffic to required AWS VPC endpoints or services: EC2, CloudWatch Logs, KMS, and SSM. Access the SSRR web console: In a browser, navigate to http://<public-or-private-IP> or use your own DNS name mapped to that IP (e.g., http://ssrr.internal.local ). The homepage provides a secure dashboard to start, stop, and monitor approved EC2 instances.
Manage servers: Use the web UI to start, stop, or restart instances. All actions are logged with username, timestamp, and instance ID. Logs can forward automatically to CloudWatch Logs or S3.
Review logs and cost summaries: Local logs: /var/log/ssrr/ CloudWatch group: SSRR/* (if enabled). Each record details user activity and instance runtime for cost tracking.
Add or remove authorized users: Administrators upload SSH public keys for web authentication under /home/ec2-user/.ssh/authorized_keys. Restart SSRR to apply: sudo systemctl restart ssrr.service
(Optional) Configure cost alerts with AWS Budgets or Cost Explorer for detailed spend analytics.
SSRR operates entirely within your VPC. Remote users connect through a browser (HTTP port 80 or DNS name) to securely control EC2 servers; no AWS IAM users or console access required.
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.