diff --git a/internal/cmd/commands/connect/ssh.go b/internal/cmd/commands/connect/ssh.go
index 275543984..82bb49d53 100644
--- a/internal/cmd/commands/connect/ssh.go
+++ b/internal/cmd/commands/connect/ssh.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/target"
 	"github.com/posener/complete"
 )
 
@@ -48,6 +49,12 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, addr string, creds credential
 	var username string
 	retCreds = creds
 
+	var tryConsume bool
+	switch string(target.SubtypeFromId(c.sessionAuthzData.TargetId)) {
+	case "tcp":
+		tryConsume = true
+	}
+
 	switch strings.ToLower(s.flagSshStyle) {
 	case "ssh":
 		// Might want -t for ssh or -tt but seems fine without it for now...
@@ -58,6 +65,9 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, addr string, creds credential
 		args = append(args, "-o", "NoHostAuthenticationForLocalhost=yes")
 
 	case "sshpass":
+		if !tryConsume {
+			return nil, nil, credentials{}, errors.New("Credentials must be consumed when using sshpass")
+		}
 		var password string
 		if len(retCreds.usernamePassword) > 0 {
 			// For now just grab the first username password credential brokered
@@ -92,7 +102,11 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, addr string, creds credential
 	case "putty", "ssh":
 
 		switch {
-		// First check if we have a private key available
+		// First check if we want to try and consume credentials
+		case !tryConsume:
+			// Do nothing
+
+		// If we want to consume check if we have a private key available first
 		case len(creds.sshPrivateKey) > 0:
 			// For now just grab the first ssh private key credential brokered
 			// Mark credential as consumed so it is not printed to user