Tag See all →

#ssm

2 stories

Cloud & Infrastructure Bug Report

SSM Session Manager stopped working after enabling KMS encryption: missing kms:Decrypt

Samuel Osei · Sep 9, 2026 · 8 min read

We enabled KMS encryption for Session Manager to meet an audit requirement and every session to our EC2 fleet failed. The instance role could not use the key, the key policy did not allow it, and private instances could not reach KMS at all. The full fix and checks.

Banner: an EC2 instance in a private subnet cut off from the NAT gateway because of a missing route

Cloud & Infrastructure Bug Report

EC2 in a new private subnet cannot reach the internet or SSM: missing route table association

John Nguyen · May 27, 2026 · 10 min read

Instances in a freshly added private subnet timed out on dnf and never showed up in Session Manager, while identical instances in older subnets were fine. The subnet had silently fallen back to the VPC main route table, which had no NAT route.