3 ms·

Had to get feature parity with GCP, huh. Is this similar to SSH via SSM in that it could be a security improvement? Can I disable port 22 and remove the SSH cli

by DGAP 6y ago

Had to get feature parity with GCP, huh. Is this similar to SSH via SSM in that it could be a security improvement? Can I disable port 22 and remove the SSH client altogether and still use AWS CloudShell on an instance?

MaxBarraclough 6y ago
> Can I disable port 22 and remove the SSH client altogether and still use AWS CloudShell on an instance? Yes, provided you whitelist the IP range for Amazon's Instance Connect service. (They don't call it Cloud Shell.) From [0]: > We recommend that your instance allows inbound SSH traffic from the recommended IP block published for the service. You have to trawl the giant JSON document that it links to, to find the relevant IP range to permit, where the region matches yours and where you see "service": "EC2_INSTANCE_CONNECT". Then, whitelist the specified IP range (obviously for incoming traffic on TCP port 22). [0] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-inst...
- jayzalowitz 6y ago
  protip: look into this for pci.
- DGAP 6y ago
  Is this different than https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html https://docs.aws.amazon.com/systems-manager/latest/userguide... ?
  - MaxBarraclough 6y ago
    Looks like yes. Here are two blog posts about it. I'm still not clear on the difference. https://carriagereturn.nl/aws/ec2/ssh/connect/ssm/2019/07/26/connect.html https://carriagereturn.nl/aws/ec2/ssh/connect/ssm/2019/07/26... https://ystatit.medium.com/different-between-ec2-instance-connect-and-session-manager-c1a0b110b474 https://ystatit.medium.com/different-between-ec2-instance-co...
    - rescbr 6y ago
      SSM connects to the instance through the agent (you're logged in as ssm-user) so you don't need to open port 22 inbound, while Instance Connect does the public key magic and connects you directly over SSH. From EC2 Instance Connect docs: "[...] it generates a one-time-use SSH public key, pushes the key to the instance where it remains for 60 seconds, and connects the user to the instance. You can use basic SSH/SFTP commands with the Instance Connect CLI." Disclaimer: I'm a SA at AWS.
tidepod12 6y ago
Can you explain what you mean? You don't "use AWS CloudShell on an instance". This isn't a service meant to be used as a bastion to SSH into your resources or something that is installed on your instances. This is primarily an addition to the AWS Management Console interface that allows you to run AWS CLI commands from your browser.
- DGAP 6y ago
  Ah you're correct, I misunderstood the feature.

by DGAP 6y ago

MaxBarraclough 6y ago

> Can I disable port 22 and remove the SSH client altogether and still use AWS CloudShell on an instance? Yes, provided you whitelist the IP range for Amazon's Instance Connect service. (They don't call it Cloud Shell.) From [0]: > We recommend that your instance allows inbound SSH traffic from the recommended IP block published for the service. You have to trawl the giant JSON document that it links to, to find the relevant IP range to permit, where the region matches yours and where you see "service": "EC2_INSTANCE_CONNECT". Then, whitelist the specified IP range (obviously for incoming traffic on TCP port 22). [0] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-inst...

jayzalowitz 6y ago
protip: look into this for pci.
DGAP 6y ago
Is this different than https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html https://docs.aws.amazon.com/systems-manager/latest/userguide... ?
- MaxBarraclough 6y ago
  Looks like yes. Here are two blog posts about it. I'm still not clear on the difference. https://carriagereturn.nl/aws/ec2/ssh/connect/ssm/2019/07/26/connect.html https://carriagereturn.nl/aws/ec2/ssh/connect/ssm/2019/07/26... https://ystatit.medium.com/different-between-ec2-instance-connect-and-session-manager-c1a0b110b474 https://ystatit.medium.com/different-between-ec2-instance-co...
  - rescbr 6y ago
    SSM connects to the instance through the agent (you're logged in as ssm-user) so you don't need to open port 22 inbound, while Instance Connect does the public key magic and connects you directly over SSH. From EC2 Instance Connect docs: "[...] it generates a one-time-use SSH public key, pushes the key to the instance where it remains for 60 seconds, and connects the user to the instance. You can use basic SSH/SFTP commands with the Instance Connect CLI." Disclaimer: I'm a SA at AWS.

tidepod12 6y ago

Can you explain what you mean? You don't "use AWS CloudShell on an instance". This isn't a service meant to be used as a bastion to SSH into your resources or something that is installed on your instances. This is primarily an addition to the AWS Management Console interface that allows you to run AWS CLI commands from your browser.

DGAP 6y ago
Ah you're correct, I misunderstood the feature.