Still keeping port 22 open and a key pair in your launch template just so someone can run rails console in staging? This guide walks through replacing SSH with AWS SSM Session Manager and ECS Exec using Terraform. It covers IAM for instance and task roles, VPC endpoints for private subnets, exec logging, rolling it out through CI, and the gotchas that eat the most time: tasks that predate enable_execute_command, log groups created by hand, and TargetNotConnectedException. It ends with a troubleshooting table and a checklist for production.