Killing session-manager-plugin leaks the AWS-side SSM session

To query a private RDS (no public IP) from a laptop, use an AWS SSM port-forwarding session through any in-VPC EC2 with the SSM agent online — no SSH keys, no open inbound ports, no security-group edits. Gotcha: terminating the local session-manager-plugin process does NOT terminate the session on the AWS side, so every restart leaks a zombie that eats the instance session slots until new tunnels silently wedge. Before opening a tunnel, sweep them: aws ssm describe-sessions --state Active --query "Sessions[?Target==$TARGET].SessionId" and terminate-session each one. Also avoid exporting static creds into a long-running tunnel process — they expire in ~1h and freeze, killing the tunnel; let the aws CLI resolve from the profile on each restart so it can refresh.