Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session

Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM service and a websocket connection is established from the machine you need to remote into. A cool solution.