3 ms·

I made a little twitter thread here (shameless ploy for followers) (I work for AWS): https://twitter.com/jrhunt/status/1144402767890436096 https://twitter.com/j

by ranman 7y ago

I made a little twitter thread here (shameless ploy for followers) (I work for AWS): https://twitter.com/jrhunt/status/1144402767890436096 https://twitter.com/jrhunt/status/1144402767890436096 * Works on amzn linux 2 - installed by default on newer versions * otherwise: $ sudo yum install ec2-instance-connect * The SSH public keys are only available for one-time use for 60 seconds in the instance metadata. * you can send up your own SSH keys `aws ec2-instance-connect send-ssh-public-key` * cloudtrail logs connections for auditing * doesn't support tag based auth but it's on the roadmap * plans to enable it in popular linux distros in addition to amzn linux 2 Install local client: $ aws s3 cp s3://ec2-instance-connect/cli/ec2instanceconnectcli-latest.tar.gz . $ pip install ec2instanceconnectcli-latest.tar.gz $ mssh instanceid

forty 7y ago
Is there an easy way to integrate that with ansible style scripts (where it needs to ssh to many instances at once)? Or is it planned?
- jonesetc 7y ago
  should be a pretty simple little connection plugin: https://docs.ansible.com/ansible/latest/dev_guide/developing_plugins.html#connection-plugins https://docs.ansible.com/ansible/latest/dev_guide/developing...
iconara 7y ago
Great to hear that tag based auth is coming. I'm at a loss about how to use it without something like that. It looks like you either have to handle each instance individually (which makes no sense where AWS has been pushing auto scaling and spot instances for a decade – instances are ephemeral in our world), or have one rule that applies to everything in the account. To me, being able to limit access to groups of instances is a required feature.
bogomipz 7y ago
Thanks for the bullet points. Can you explain what "tag based auth" is and how it will work?'
hitpointdrew 7y ago
>otherwise: $ sudo yum install ec2-instance-connect I assume that "sudo apt install ec2-instance-connect" will also work?
- KaiserPro 7y ago
  Only if its pushed to the correct repo. AL2 has amazon specific stuff in its repos, Ubuntu does, eventually

by ranman 7y ago

forty 7y ago

Is there an easy way to integrate that with ansible style scripts (where it needs to ssh to many instances at once)? Or is it planned?

jonesetc 7y ago
should be a pretty simple little connection plugin: https://docs.ansible.com/ansible/latest/dev_guide/developing_plugins.html#connection-plugins https://docs.ansible.com/ansible/latest/dev_guide/developing...

iconara 7y ago

Great to hear that tag based auth is coming. I'm at a loss about how to use it without something like that. It looks like you either have to handle each instance individually (which makes no sense where AWS has been pushing auto scaling and spot instances for a decade – instances are ephemeral in our world), or have one rule that applies to everything in the account. To me, being able to limit access to groups of instances is a required feature.

bogomipz 7y ago

Thanks for the bullet points. Can you explain what "tag based auth" is and how it will work?'

hitpointdrew 7y ago

>otherwise: $ sudo yum install ec2-instance-connect I assume that "sudo apt install ec2-instance-connect" will also work?

KaiserPro 7y ago
Only if its pushed to the correct repo. AL2 has amazon specific stuff in its repos, Ubuntu does, eventually