Elastic Compute Service:Connect to an instance by using Session Manager CLI (ali-instance-cli)

Before you can use ali-instance-cli, use your Alibaba Cloud account to enable Session Manager. You can enable Session Manager only in the ECS console. To enable Session Manager, perform the following steps:

You can use Session Manager to connect to only instances in the Running state.

aliyun ecs DescribeInstanceStatus --region cn-hangzhou --RegionId 'cn-hangzhou' --InstanceId.1 'i-bp1******'

{
  "TotalCount": 1,
  "RequestId": "A413****-****-****-****-****611B",
  "PageSize": 1,
  "PageNumber": 1,
  "InstanceStatuses": {
    "InstanceStatus": [
      {
        "Status": "Running",
        "InstanceId": "i-bp1******"
      }
    ]
  }
}

Session Manager depends on Cloud Assistant. You can use one of the following methods to check whether Cloud Assistant Agent is installed on the instance.

Cloud Assistant Agent is pre-installed on ECS instances that are created from Alibaba Cloud public images on or after December 1, 2017. For ECS instances created before December 1, 2017, you must manually install Cloud Assistant Agent. For more information, see Install Cloud Assistant Agent.

aliyun ecs DescribeCloudAssistantStatus --region cn-hangzhou --RegionId 'cn-hangzhou' --InstanceId.1 'i-bp1******'

{
  "TotalCount": 1,
  "PageSize": 1,
  "RequestId": "DB34****-****-****-****-****A749",
  "NextToken": "",
  "PageNumber": 1,
  "InstanceCloudAssistantStatusSet": {
    "InstanceCloudAssistantStatus": [
      {
        "CloudAssistantVersion": "2.2.3.857",
        "SupportSessionManager": true,
        "InstanceId": "i-bp1******",
        "InvocationCount": 4,
        "OSType": "Linux",
        "CloudAssistantStatus": "true",
        "LastHeartbeatTime": "2024-12-10T02:38:04Z",
        "LastInvokedTime": "2024-12-08T16:02:45Z",
        "ActiveTaskCount": 0
      }
    ]
  }
}

If the command line does not respond after you run an ali-instance-cli command, the corresponding instance may not be in the Running state. Check the status of the instance. For more information, see the Check whether the instance to which you want to connect is in the Running state section of this topic.

If the command line does not respond after you run an ali-instance-cli command, the required ports may not be open for outbound traffic in the security groups of the corresponding instance. By default, basic security groups open all ports for outbound traffic. The preceding issue may occur if you modify the outbound rules of basic security groups or use advanced security groups for the instance.

If the DeliveryTimeout error is reported as shown in the following figure after you run an ali-instance-cli command, Cloud Assistant Agent may be unavailable on the corresponding instance. Check the status of Cloud Assistant Agent. For more information, see the Check whether Cloud Assistant Agent is installed on the instance to which you want to connect section of this topic.

If the session manager is disabled, please enable first error message appears after you run an ali-instance-cli command, Session Manager is disabled. Enable Session Manager in the ECS console. For more information, see the Enable Session Manager section of this topic.

After you connect to an instance by using Session Manager, the connection is automatically closed if you do not perform operations for an extended period of time. By default, the idle timeout period for a connection is 3 minutes. You can use the --idle-timeout parameter to specify a custom idle timeout period.

For example, run the following command to connect to an instance and configure the connection to be automatically closed after 10 minutes of inactivity.

./ali-instance-cli session --instance instance-id --idle-timeout 600

If an error occurs when you use ali-instance-cli, you can view logs to identify and troubleshoot the issue.

• View the logs of ali-instance-cli. When you use ali-instance-cli, a log directory is generated in the directory in which ali-instance-cli resides. Example: ~/log/aliyun_ecs_session_log.2022XXXX. You can view the logs of ali-instance-cli in the log directory.

• View the logs of Cloud Assistant Agent in one of the following directories based on the operating system:

  • Linux

    /usr/local/share/aliyun-assist/<Version number of Cloud Assistant Agent>/log/

  • Windows

    C:\ProgramData\aliyun\assist\<Version number of Cloud Assistant Agent>\log