EC2 Open Terminal fails when Session Manager KMS encryption is enabled
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
## Problem
EC2 Open Terminal fails when Session Manager uses `Standard_Stream` with a nonempty `kmsKeyId`.
The error is:
Encountered error while initiating handshake.
KMSEncryption failed on client with status 2 error:
Installed version of CLI does not support Session Manager encryption feature.
The same connection works with `aws ssm start-session`. Disabling KMS encryption is not an acceptable workaround.
## Steps to reproduce the issue
1. Enable KMS encryption in Session Manager preferences.
2. Open AWS Explorer in VS Code.
3. Expand EC2 and right-click a managed instance.
4. Select **Open Terminal**.
5. Observe the KMS handshake error.
6. Run `aws ssm start-session` with the same identity, instance, and Region and confirm it succeeds.
## Expected behavior
EC2 Open Terminal should support Session Manager sessions that require KMS encryption.
## System details (run `AWS: About` and/or `Amazon Q: About`)
- OS: Windows 11 Pro 10.0.22631, x64
- Visual Studio Code version: 1.129.1
- AWS Toolkit version: 4.11.0
- Amazon Q version: Not applicable
- AWS CLI version: 2.15.33
- Session Manager plugin version: 1.2.814.0
Contributor guide
Research direction
Start at the AWS Explorer EC2 “Open Terminal” entry point and compare its Session Manager startup flow with `aws ssm start-session` using the same identity, instance, and Region. Reproduce with a nonempty `kmsKeyId`; done means EC2 Open Terminal completes the KMS-encrypted Session Manager handshake instead of reporting that encryption is unsupported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript, vscode
- Domain
- cloud, devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100