Kestro runs your aws ssm start-session: the right document depending on whether you are aiming at the instance or a host behind it, the parameters properly escaped, your profile and region explicit. IAM signs, as always. But there is nothing left to copy out.
macOS 11+ · Windows soon
The same session, twice
The line on the left is the one Kestro runs, JSON included, and the one it shows you in the tunnel’s settings.
Today
$ aws ssm start-session \ --target i-0abc123def456 \ --document-name AWS-StartPortForwardingSessionToRemoteHost \ --parameters '{"host":["pg.eu-west-1.rds"],"portNumber":["5432"],"localPortNumber":["5432"]}' \ --profile prod --region eu-west-1 # and you have to know which of the two documents you want An error occurred (TargetNotConnected)
With Kestro
One switch, in the menu bar. The document is chosen from what you are aiming at. Profile and region travel with the tunnel. The JSON is escaped for you, twice. # and if you would rather keep the keyboard: $ psql "$(kestro url billing-db)"
Point by point
| aws ssm by hand | With Kestro | |
|---|---|---|
| The program that opens the tunnel | aws + the session-manager-plugin | The same ones, launched by Kestro |
| Your credentials | the aws CLI’s | the aws CLI’s, untouched |
| Which document to use | to choose: to the instance, or to a remote host | chosen from the target you enter |
| The parameters | JSON to write and escape inside the shell | fields, escaped twice for you |
| Profile and region | flags, or environment variables | attached to the tunnel, they travel with it |
| The local port is already taken | the error arrives on launch | “free” or “taken”, before you confirm |
| After the Mac sleeps | relaunch it by hand | comes back on its own, if you ticked it |
| A database that is not behind SSM | another tool, another syntax | the same list: SSH, bastion, Cloud SQL, Google VM |
| In a script, in CI, on a server | yes, that is what the CLI is for | no, Kestro is a desktop app |
| Cost | free, AWS charges aside | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once |
Checked on 4 August 2026 · AWS CLI v2
What Kestro adds
None of them touches how the session opens: aws does the work, and IAM signs. They are about everything around it.
AWS-StartPortForwardingSession for a port on the instance, AWS-StartPortForwardingSessionToRemoteHost for an RDS or an ElastiCache behind it. Kestro decides from what you entered: that is the distinction you look up in the documentation every single time.
Parameters travel as JSON, inside a shell string: two layers of escaping, and a hostname from a colleague that breaks the line in the wrong place. Kestro protects each layer, separately.
No environment variable to set, no .envrc rewriting what you thought you had chosen: the flags are explicit and attached to the door. Two tunnels onto two accounts open side by side.
An EC2 through Session Manager, a Cloud SQL database, a Google VM through IAP, an SSH bastion: four tools, four syntaxes. One list, and the same switch.
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
When the CLI is enough
Better said here than discovered after paying.
Kestro is a desktop app: it needs a session to be open. In a CI job, in a container, in a systemd unit, the CLI is what you want, and nothing else.
Session Manager does far more than port forwarding: interactive shells, running commands, file transfer, compliance. Kestro uses one door only: the one that opens a local port.
Kestro only runs on macOS 11 and later. The Windows version is in the works; there is no Linux version planned.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
No, it runs it. The command executed is an ordinary aws ssm start-session, with its document and its parameters, shown as-is in the tunnel’s settings. Kestro does not speak the Session Manager protocol: it runs your CLI, which runs the plugin.
Yes, session-manager-plugin is required by AWS for any port forwarding. Kestro says so rather than failing quietly: when the tool is missing it names it and offers the install line. It never downloads a binary on your behalf.
No, and Kestro never sees any of them. The aws CLI, already configured on your machine, carries the authentication: SSO, profile, assumed role, whichever. Nothing passes through our servers, and since there is no account to create, we do not even know that you are opening a session.
That is exactly the case that costs time on the command line: set the right profile, the right region, then remember to put them back. In Kestro both are attached to the tunnel: they travel with it, and two tunnels onto two accounts open side by side without switching anything.
Nothing in particular: your aws CLI, your plugin and your profiles are where they were, untouched. Kestro writes to none of them. You go back to typing your commands as before.
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.