4 ms·
If you're on AWS, you can create a private SSH host without needing to open any ports to the internet, using AWS Systems Manager: - Create an EC2 instance in a
by lenova 6y ago
If you're on AWS, you can create a private SSH host without needing to open any ports to the internet, using AWS Systems Manager:
- Create an EC2 instance in a private subnet, and assign the AmazonSSMManagedInstanceCore IAM role to it
- Install the AWS CLI tools on your desktop
- Add a function to your .bash_profile like this:
function jumphost() {
JUMP_ID=$(aws ec2 describe-instances --filter "Name=tag:Name,Values=my-jumphost-name" --query "Reservations[].Instances[].InstanceId[]")
echo "Starting jumphost..."
aws ec2 start-instances --instance-ids $JUMP_ID
sleep 30
aws ssm start-session --target $JUMP_ID
}
Then just run "jumphost" from your terminal and boom, SSH'ed in via the magic of SSM.
Bonus points: add a cronjob to your jumphost to shutdown every X hours in case you forget ;-)
- kosinus 6y agoOh, that's interesting! Didn't know AWS had that ability. Maybe then there are also some SDK functions I don't know about? I wonder why Packer doesn't go this route. Super tiny downside to your approach: you'll be paying for storage of that instance while shut down, I guess. But that's probably peanuts.
- gtsteve 6y agoI was about to comment that I looked into this a while back and they thought it would be too complicated to implement... but it seems that it was actually implemented [0] earlier this year. I haven't tried it out but that seems quite promising to me. [0] https://github.com/hashicorp/packer/pull/9082 https://github.com/hashicorp/packer/pull/9082
- markfive 6y agoSystems Manager also supports Port Forwarding: https://aws.amazon.com/blogs/aws/new-port-forwarding-using-aws-system-manager-sessions-manager/ https://aws.amazon.com/blogs/aws/new-port-forwarding-using-a...
- mdaniel 6y agoI've gotten a lot of mileage out of Sigil (https://github.com/danmx/sigil#readme https://github.com/danmx/sigil#readme ) which supports starting sessions via Name tag, instance-id, or private-dns-name in order to save one the need to use awscli in a lot of cases; it also supports the handy `sigil ls` to show the connected instances, since trying to start an SSM connection with an instance whose agent is offline produces a dumb error message with start-session --- as an aside: `function name()` is redundant; the `function name {` syntax is a bashism, `name() {` is the posix syntax and you may find `aws ec2 wait instance-running` handy instead of the sleep: https://docs.aws.amazon.com/cli/latest/reference/ec2/wait/instance-running.html https://docs.aws.amazon.com/cli/latest/reference/ec2/wait/in...