Remote file editing via SSM session results in "open failed: administratively prohibited"

## System details

- OS: MacOS 15.2 (24C101)
- Visual Studio Code version: 1.99.2
- AWS Toolkit version: 3.54.0

## Question

Does the AWS Toolkit extension support remote file editing/browsing via SSM? Is there anywhere a step by guide or video demonstrating this feature?

After many experiments and research, ChatGPT told me:

> SSM port forwarding only supports forwarding the ports you explicitly
> define (e.g., port 22 in your case), but not additional dynamic forwarding,
> which VS Code needs for things like terminal, file sync, and extension host.

This might be a lie but I have not way to verify except asking here.

I also wanted to contact the SSM team via AWS support (Case ID 174431348800238) but they claim

> Please note- We do not have expertise/familiarity with VS code. However we can suggest below recommendations if this works your use case.

So here I am.

### Context

I want to provide my developers instructions to remotely edit code from
their Windows Desktops (Citrix).

• The remote instance is based on AL2023
• Developers use VSCode to edit code remotely
• Access to the EC2 instance is only available via SSM

1 Access to the instance via awscli works fine
══════════════════════════════════════════════

• Using `ssm start-session' works!
┌────
│ aws ssm start-session --target $EC2_ID --document-name SSM-SessionManagerRunShell
└────

• Using `ssh ' works!
┌────
│ ssh i-xyz123
└────

`ssh_config' is:
┌────
│ cat ~/.ssh/config
│
│ Host i-* mi-*
│ ProxyCommand sh -c "aws --profile my-profile ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
└────

2 Access to the instance via VSCode almost works
════════════════════════════════════════════════

Logs: [Logs: VSCode connect to instance]

• authentication works
• `~/.vscode-server' is detected/created in the remote instance
• dynamic port forward fails:
┌────
│ [21:04:03.092] Failed to set up socket for dynamic port forward to remote port 44751: Socket closed. TCP port forwarding may be disabled, or the remote server may have crashed. See the VS Code Server log above for details.
│ [21:04:03.094] stderr> channel 2: open failed: administratively prohibited: open failed
│ [21:04:03.095] FEHLER: Die TCP-Portweiterleitung scheint auf dem Remotehost deaktiviert zu sein. Stellen Sie sicher, dass der sshd_config „AllowTcpForwarding yes“ aufweist. Wenden Sie sich bei Bedarf an den Systemadministrator.
│ [21:04:03.096] stderr> channel 3: open failed: administratively prohibited: open failed
│ [21:04:03.096] Failed to set up socket for dynamic port forward to remote port 44751: Socket closed. TCP port forwarding may be disabled, or the remote server may have crashed. See the VS Code Server log above for details.
└────

Environment info:

• VSCode extentions installed:
⁃ [aws-toolkit-vscode]
⁃ [ms-vscode-remote.remote-ssh]

• *sshd* configuration allows tcp forwarding:
┌────
│ [user.name@i-03b5fb83783ecfac6 ~]$ sudo cat /etc/ssh/sshd_config | grep Forward
│
│ #AllowAgentForwarding yes
│ AllowTcpForwarding yes
│ #X11Forwarding no
│ # X11Forwarding no
│ # AllowTcpForwarding no
│ DisableForwarding yes
│
│ [user.name@i-03b5fb83783ecfac6 ~]$ sudo sshd -T | grep allowtcp
│
│ allowtcpforwarding yes
└────

[aws-toolkit-vscode]
<[https://marketplace.visualstudio.com/items/?itemName=AmazonWebServices.aws-toolkit-vscode ](https://marketplace.visualstudio.com/items/?itemName=AmazonWebServices.aws-toolkit-vscode)>

[ms-vscode-remote.remote-ssh]
<[https://marketplace.visualstudio.com/items/?itemName=ms-vscode-remote.remote-ssh ](https://marketplace.visualstudio.com/items/?itemName=ms-vscode-remote.remote-ssh)>

3 INFO Logs: VSCode connect to instance
═══════════════════════════════════════

Attached.
Instance ID//Managed instance ID: i-03b5fb83783ecfac6

No source files or tests are named. Start by reproducing the VS Code Remote-SSH connection with the documented SSM commands and review the attached connection logs and SSH forwarding configuration; done means providing a verified setup guide or clearly documenting whether SSM supports this workflow.

Written by the indexing model from the issue text.