Tunnels: Your VPC, One Toggle Away
SimpleSSM 1.2 introduces Tunnels — secure port forwarding to anything inside your VPC, with no VPN, no bastion host, and no CLI setup.
A few weeks ago I needed to run some queries against an RDS database that lives in a private subnet. No VPN set up, no bastion, no appetite for either. Then I stumbled onto a little-known corner of AWS Systems Manager: port forwarding through an EC2 instance to a remote host. One long CLI incantation later, my local MySQL client was talking to a database that has no public IP whatsoever. It felt like magic – the kind of magic that deserves a UI.
So that’s what 1.2 is. Tunnels.
What it does
A tunnel forwards a port on your Mac, through one of your EC2 instances, to any host that instance can reach – an RDS database, an ElastiCache cluster, an internal admin panel. Point your database client (or browser, or anything that speaks TCP) at 127.0.0.1 and work as if you were inside the VPC.
Traffic rides AWS Session Manager, so there’s nothing to expose: no inbound ports, no public IPs, no jump boxes to babysit. If your instance can SSM, you can tunnel.
Built the SimpleSSM way
Everything runs natively inside the app — SimpleSSM speaks the Session Manager protocol directly, so unlike other tools there’s no AWS CLI and no session-manager-plugin to install. Beyond that:
– Save your tunnels. Name them (“Prod DB”), configure them once, and they live in your sidebar with a simple on/off toggle.
– Menu bar control. Flip a tunnel on from the menu bar without opening the main window — connect to prod, run your query, flip it off.
– Live status. See at a glance whether a tunnel is ready or in use, how long it’s been connected, and grab the local address with one click.
– Multiple connections. GUI database tools that open connection pools just work — each connection gets its own SSM session under the hood.
– Keepalives. Your connection survives your lunch break. Idle sessions that would normally be reaped by Session Manager’s timeout stay up as long as a client is attached.
Free users get one saved tunnel to see what the fuss is about. Pro removes the limit.
About those mobile apps…
If you read SimpleSSM On the Go (https://colemaco.com/news/post/simplessm-on-the-go/) and have been refreshing the App Store since – I owe you a small apology. The iPhone and iPad apps are late, and Tunnels is the honest reason: it was too good a feature to sit on, and it jumped the queue. The good news is the wait is nearly over. The mobile apps are feature-complete and in final testing now, including a new unified Pro subscription that covers Mac, iPad, and iPhone with one purchase. Soon. Genuinely soon.