7 ms·

Alternately you can inventory your instances in AWS Systems Manager and start an SSH session directly from the AWS CLI itself [1] -- no Bastion servers or SSH k

Alternately you can inventory your instances in AWS Systems Manager and start an SSH session directly from the AWS CLI itself [1] -- no Bastion servers or SSH key management necessary, pure IAM access only. [1] https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-start-cli https://docs.aws.amazon.com/systems-manager/latest/userguide...

oneplane 6y ago
Downside is that it doubles access options when you have a mixed environment, i.e. multiple clouds and/or non-cloud servers. Other than that it's a great solution if IAM is your default user source.
WaxProlix 6y ago
Always glad to see one of our products mentioned :) Huge shameless plug for the coolness that is Session Manager, I can only think of a few scenarios where you wouldn't just prefer it over the alternatives. If you haven't played with it (or other SSM stuff), you totally should! It's cool and useful and easy and more or less free.
- a012 6y ago
  I'd love to use SSM with other OSes (i.e. FreeBSD) than just Amazon Linux & Ubuntu which are supported.
  - WaxProlix 6y ago
    You can! The agent can be installed on almost any linux flavor, and is open source on GitHub, so it can be compiled and installed on any EC2 machines (or on-prem machines) you want. (This might not be easy, I haven't done it myself) If you can make a good case for it, open a ticket or make a stink on the forums and there's a chance an engineer can be tasked to add it to their list of Officially Supported Platforms. This is how eg raspbian got added, though I don't know if the program is still running for adding platforms as it's been a few years.
- debaserab2 6y ago
  It was a total no-brainer once we discovered it. Really nice work. If you're interested in more feedback, I'd be happy to share. As with many things AWS, there were some undocumented rougher edges that took some trial and error to figure. Although the end result was well worth it. Totally understand if you're not on HN to do that sort of thing, though.
  - WaxProlix 6y ago
    Hey, I'm all ears. Just an engineer, but customer feedback is taken super seriously (albeit with a tragically long turnaround time - it's a surprisingly large organization with a lot of irons on a lot of fires). I'll totally pass on anything you have to say though. e: or put an email in your profile and I'll even reach out!
    - debaserab2 6y ago
      I don't keep an email in my profile but you can find me here: andy@threadsculture.com
- zozos 6y ago
  Is there a way to use SSM without using the access keys? I feel using access keys is incredibly not secure because rotating keys is a hassle and people might not do them all the time. Also can u restrict access to ssh through ssm to certain ips? Maybe I might have missed these, so any help would be appreciated.
  - vladvasiliu 6y ago
    > Is there a way to use SSM without using the access keys? I feel using access keys is incredibly not secure because rotating keys is a hassle and people might not do them all the time. Technically there is, you can use federated login. Might not be very convenient, depending on your identity provider. A solution I use, while not technically "not using access kys" is storing them in the system credential store with aws-vault [0]. Works on Windows, Linux and Mac. And you can combine this with multi factor auth. > Also can u restrict access to ssh through ssm to certain ips? Yes, with an IAM policy. The policy below requires connecting with an MFA and from a specific IP range. It only allows connecting to a specific instance. { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "ssm:StartSession", "Resource": [ "arn:aws:ec2:eu-west-3:123123123123:instance/i-123123123123", "arn:aws:ssm:eu-west-3::document/AWS-StartPortForwardingSession", "arn:aws:ssm:eu-west-3::document/AWS-StartSSHSession" ], "Condition": { "IpAddress": { "aws:SourceIp": "1.2.3.4/32" }, "BoolIfExists": { "aws:MultiFactorAuthPresent": "true" } } } ] } [0] AWS Vault: https://github.com/99designs/aws-vault/ https://github.com/99designs/aws-vault/
voganmother42 6y ago
Or you can run ssm agent on a fargate task for double the fun (just need to register as hybrid and remember to clean up (scheduled lambda works a treat for this)
- 616c 6y ago
  This is a neat concept and made reading the article and thread worth it. Thanks.
kevinkeller 6y ago
Does this still work if folks are authenticated via federation/SAML instead of as IAM users?
- ciceryadam 6y ago
  Yep.
m1keil 6y ago
Also worth mentioning you can also tunnel with SSM, so it's possible to use plain SSH or do anything that you usually used to accomplish with bastion. https://github.com/elpy1/ssh-over-ssm https://github.com/elpy1/ssh-over-ssm
- vladvasiliu 6y ago
  While it's possible to do port forwarding with SSM [0] I would encourage people to test it well. I've tried using it for development, and it was a terrible experience. The connections would hang all the time for no reason. I ended up starting an SSH session (via SSM) and done the port forwarding via that... [0] https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-start-port-forwarding https://docs.aws.amazon.com/systems-manager/latest/userguide...

oneplane 6y ago

Downside is that it doubles access options when you have a mixed environment, i.e. multiple clouds and/or non-cloud servers. Other than that it's a great solution if IAM is your default user source.

WaxProlix 6y ago

Always glad to see one of our products mentioned :) Huge shameless plug for the coolness that is Session Manager, I can only think of a few scenarios where you wouldn't just prefer it over the alternatives. If you haven't played with it (or other SSM stuff), you totally should! It's cool and useful and easy and more or less free.

a012 6y ago
I'd love to use SSM with other OSes (i.e. FreeBSD) than just Amazon Linux & Ubuntu which are supported.
- WaxProlix 6y ago
  You can! The agent can be installed on almost any linux flavor, and is open source on GitHub, so it can be compiled and installed on any EC2 machines (or on-prem machines) you want. (This might not be easy, I haven't done it myself) If you can make a good case for it, open a ticket or make a stink on the forums and there's a chance an engineer can be tasked to add it to their list of Officially Supported Platforms. This is how eg raspbian got added, though I don't know if the program is still running for adding platforms as it's been a few years.
debaserab2 6y ago
It was a total no-brainer once we discovered it. Really nice work. If you're interested in more feedback, I'd be happy to share. As with many things AWS, there were some undocumented rougher edges that took some trial and error to figure. Although the end result was well worth it. Totally understand if you're not on HN to do that sort of thing, though.
- WaxProlix 6y ago
  Hey, I'm all ears. Just an engineer, but customer feedback is taken super seriously (albeit with a tragically long turnaround time - it's a surprisingly large organization with a lot of irons on a lot of fires). I'll totally pass on anything you have to say though. e: or put an email in your profile and I'll even reach out!
  - debaserab2 6y ago
    I don't keep an email in my profile but you can find me here: andy@threadsculture.com
zozos 6y ago
Is there a way to use SSM without using the access keys? I feel using access keys is incredibly not secure because rotating keys is a hassle and people might not do them all the time. Also can u restrict access to ssh through ssm to certain ips? Maybe I might have missed these, so any help would be appreciated.
- vladvasiliu 6y ago
  > Is there a way to use SSM without using the access keys? I feel using access keys is incredibly not secure because rotating keys is a hassle and people might not do them all the time. Technically there is, you can use federated login. Might not be very convenient, depending on your identity provider. A solution I use, while not technically "not using access kys" is storing them in the system credential store with aws-vault [0]. Works on Windows, Linux and Mac. And you can combine this with multi factor auth. > Also can u restrict access to ssh through ssm to certain ips? Yes, with an IAM policy. The policy below requires connecting with an MFA and from a specific IP range. It only allows connecting to a specific instance. { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "ssm:StartSession", "Resource": [ "arn:aws:ec2:eu-west-3:123123123123:instance/i-123123123123", "arn:aws:ssm:eu-west-3::document/AWS-StartPortForwardingSession", "arn:aws:ssm:eu-west-3::document/AWS-StartSSHSession" ], "Condition": { "IpAddress": { "aws:SourceIp": "1.2.3.4/32" }, "BoolIfExists": { "aws:MultiFactorAuthPresent": "true" } } } ] } [0] AWS Vault: https://github.com/99designs/aws-vault/ https://github.com/99designs/aws-vault/

voganmother42 6y ago

Or you can run ssm agent on a fargate task for double the fun (just need to register as hybrid and remember to clean up (scheduled lambda works a treat for this)

616c 6y ago
This is a neat concept and made reading the article and thread worth it. Thanks.

kevinkeller 6y ago

Does this still work if folks are authenticated via federation/SAML instead of as IAM users?

ciceryadam 6y ago
Yep.

m1keil 6y ago

Also worth mentioning you can also tunnel with SSM, so it's possible to use plain SSH or do anything that you usually used to accomplish with bastion. https://github.com/elpy1/ssh-over-ssm https://github.com/elpy1/ssh-over-ssm

vladvasiliu 6y ago
While it's possible to do port forwarding with SSM [0] I would encourage people to test it well. I've tried using it for development, and it was a terrible experience. The connections would hang all the time for no reason. I ended up starting an SSH session (via SSM) and done the port forwarding via that... [0] https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-start-port-forwarding https://docs.aws.amazon.com/systems-manager/latest/userguide...