7 ms·

I've never used Tailscale, but I want to highlight specifically for working with AWS, you could consider using AWS Systems Manager to access machines that are i

I've never used Tailscale, but I want to highlight specifically for working with AWS, you could consider using AWS Systems Manager to access machines that are in private VPCs[1][2]. This has the advantage of reusing the same credentials used already for AWS, as well as being able to further restrict exactly what can be done with them. [1]: https://aws.amazon.com/premiumsupport/knowledge-center/systems-manager-ssh-vpc-resources/ https://aws.amazon.com/premiumsupport/knowledge-center/syste... [2]: https://medium.com/hackernoon/ditch-your-ssh-keys-and-enable-aws-ssm-ec1c2b27350c https://medium.com/hackernoon/ditch-your-ssh-keys-and-enable...

danenania 4y ago
You can also use AWS Client VPN. It’s not as user-friendly as tailscale, and probably more expensive(?), but it works well enough. It’s also pretty easy to provision with IaC—not sure if that’s the case for tailscale?
- thedougd 4y ago
  I'm currently evaluating Tailscale and other VPN solutions as AWS Client VPN doesn't look like it's going to work for us. AWS Client VPN does not offer any means of unattended configuration or mass distribution. All they offer is a self service portal from which you can download the installable, the profile, and directions. Each use has to manually import the profile into their client. I'm stunned they're missing this as it would prevent any sizable organization from adopting it.
  - danenania 4y ago
    Yeah it’s not ideal. It’s nice not to have to run any kind of agent, and to use IAM for access control (not that IAM is so wonderful, but it plugs in easily). I agree though it could be much smoother.
Hawxy 4y ago
There's also a new port forwarding parameter on session manager so you can easily connect to a private RDS via a bastion host. https://aws.amazon.com/about-aws/whats-new/2022/05/aws-systems-manager-support-port-forwarding-remote-hosts-using-session-manager/ https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste... https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-remote-port-forwarding https://docs.aws.amazon.com/systems-manager/latest/userguide...
- nighthawk454 4y ago
  Oh wow, I’m still using ssh tunnels through the bastion. Gonna try this next week, thanks!
vosper 4y ago
I’ve used Twingate for this and found it very easy to setup and use. No idea whether experts consider it a good option.
jvolkman 4y ago
We still need bastion hosts to connect to RDS, but they're no longer accessible from the internet since we use SSM. `ssh aws-bastion` invokes a ProxyCommand that: 1) finds an actual bastion host by tag using ec2 describe-instances 2) generates a short-lived ssh key and adds it to the ssh agent 3) sends the temporary key to the bastion using ec2-instance-connect send-ssh-public-key 4) starts the SSM/ssh session using AWS-StartSSHSession Since it's SSH, we can port forward, use multiplexing, etc. We use Google as the IdP, via AWS SSO. Bastions periodically sync users from a Google group.
- paranoidrobot 4y ago
  Someone on Reddit posted a shell script[1] that does all the connection setup, key-sending, etc that's a useful base to work from. [1] https://www.reddit.com/r/aws/comments/df6uip/ssm_tunnelling_ec2_what_about_rds/f85pcoy/ https://www.reddit.com/r/aws/comments/df6uip/ssm_tunnelling_...
- moltar 4y ago
  Why do you need steps 2 and 3? I’m able to use SSM with agent without any SSH keys. Also proxying to RDS. Only AWS credentials are required.
  - jvolkman 4y ago
    Yeah, SSM supports just opening a terminal on the remote host without ssh. We started with regular ssh bastions though so I just stuck with that. They're just no longer routeable from outside.
- CubsFan1060 4y ago
  This may be of interest to you. https://aws.amazon.com/about-aws/whats-new/2022/05/aws-systems-manager-support-port-forwarding-remote-hosts-using-session-manager/ https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste...
  - jvolkman 4y ago
    It still requires the bastion host though, right? In which case I'd prefer to just use ssh since it's more familiar. Also, intellij's built-in database tools support ssh tunneling, it 'just works' with the ProxyCommand method.
metadat 4y ago
Tailscale is insanely easy, simple, and pleasant to setup/manage compared to AWS anything. The thought of using a cloud-specific solution is kind of disgusting in comparison. If Tailscale-the-product ever goes rogue or evil, I can always self-host wg or a full on tailscale-equivalent mesh myself. I sleep well knowing this.
- p_l 4y ago
  There's even a mostly feature complete open source control +DERP server on headscale
  - metadat 4y ago
    Thanks for mentioning it by name. Yeah, headscale is very badass.
- gzer0 4y ago
  https://github.com/juanfont/headscale https://github.com/juanfont/headscale If you were looking for an open source, self-hosted implementation of the Tailscale control server (as far as I know, that is the only portion of tailscale that tailscale keeps proprietary, and this is the best open source implementation of it). Edit: wow, this project has really grown from when I last saw it. It is able to configure the vast majority of tailscales base featureset such as ACLs, magic DNS, taildrop file sharing, and so much more. Incredible.
  - 369548684892826 4y ago
    Thanks for pointing this out, going to give it a whirl! Does this solve the thing about having to login using one of Google, Microsoft or Github accounts?
    - ratg13 4y ago
      You can use regular tailscale with an e-mail account.
deleted 4y ago
[deleted]
benmanns 4y ago
FYI when AWS had their little oopsie with the EC2 management APIs not too long ago, I couldn’t connect to an instance via Systems Manager. I also couldn’t adjust my security groups to enable SSH. I also couldn’t shut down the instance. AWS refused to provide any credits as their SLA only covers when the instances are not publicly accessible.
digianarchist 4y ago
We're using AWS SSM to allow access from a developer's machine to a locked down k8s cluster in AWS. It works but performance is awful. Slow connection times and pushing images has slow throughput.

danenania 4y ago

You can also use AWS Client VPN. It’s not as user-friendly as tailscale, and probably more expensive(?), but it works well enough. It’s also pretty easy to provision with IaC—not sure if that’s the case for tailscale?

thedougd 4y ago
I'm currently evaluating Tailscale and other VPN solutions as AWS Client VPN doesn't look like it's going to work for us. AWS Client VPN does not offer any means of unattended configuration or mass distribution. All they offer is a self service portal from which you can download the installable, the profile, and directions. Each use has to manually import the profile into their client. I'm stunned they're missing this as it would prevent any sizable organization from adopting it.
- danenania 4y ago
  Yeah it’s not ideal. It’s nice not to have to run any kind of agent, and to use IAM for access control (not that IAM is so wonderful, but it plugs in easily). I agree though it could be much smoother.

Hawxy 4y ago

There's also a new port forwarding parameter on session manager so you can easily connect to a private RDS via a bastion host. https://aws.amazon.com/about-aws/whats-new/2022/05/aws-systems-manager-support-port-forwarding-remote-hosts-using-session-manager/ https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste... https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-remote-port-forwarding https://docs.aws.amazon.com/systems-manager/latest/userguide...

nighthawk454 4y ago
Oh wow, I’m still using ssh tunnels through the bastion. Gonna try this next week, thanks!

vosper 4y ago

I’ve used Twingate for this and found it very easy to setup and use. No idea whether experts consider it a good option.

jvolkman 4y ago

We still need bastion hosts to connect to RDS, but they're no longer accessible from the internet since we use SSM. `ssh aws-bastion` invokes a ProxyCommand that: 1) finds an actual bastion host by tag using ec2 describe-instances 2) generates a short-lived ssh key and adds it to the ssh agent 3) sends the temporary key to the bastion using ec2-instance-connect send-ssh-public-key 4) starts the SSM/ssh session using AWS-StartSSHSession Since it's SSH, we can port forward, use multiplexing, etc. We use Google as the IdP, via AWS SSO. Bastions periodically sync users from a Google group.

paranoidrobot 4y ago
Someone on Reddit posted a shell script[1] that does all the connection setup, key-sending, etc that's a useful base to work from. [1] https://www.reddit.com/r/aws/comments/df6uip/ssm_tunnelling_ec2_what_about_rds/f85pcoy/ https://www.reddit.com/r/aws/comments/df6uip/ssm_tunnelling_...
moltar 4y ago
Why do you need steps 2 and 3? I’m able to use SSM with agent without any SSH keys. Also proxying to RDS. Only AWS credentials are required.
- jvolkman 4y ago
  Yeah, SSM supports just opening a terminal on the remote host without ssh. We started with regular ssh bastions though so I just stuck with that. They're just no longer routeable from outside.
CubsFan1060 4y ago
This may be of interest to you. https://aws.amazon.com/about-aws/whats-new/2022/05/aws-systems-manager-support-port-forwarding-remote-hosts-using-session-manager/ https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste...
- jvolkman 4y ago
  It still requires the bastion host though, right? In which case I'd prefer to just use ssh since it's more familiar. Also, intellij's built-in database tools support ssh tunneling, it 'just works' with the ProxyCommand method.

metadat 4y ago

Tailscale is insanely easy, simple, and pleasant to setup/manage compared to AWS anything. The thought of using a cloud-specific solution is kind of disgusting in comparison. If Tailscale-the-product ever goes rogue or evil, I can always self-host wg or a full on tailscale-equivalent mesh myself. I sleep well knowing this.

p_l 4y ago
There's even a mostly feature complete open source control +DERP server on headscale
- metadat 4y ago
  Thanks for mentioning it by name. Yeah, headscale is very badass.
gzer0 4y ago
https://github.com/juanfont/headscale https://github.com/juanfont/headscale If you were looking for an open source, self-hosted implementation of the Tailscale control server (as far as I know, that is the only portion of tailscale that tailscale keeps proprietary, and this is the best open source implementation of it). Edit: wow, this project has really grown from when I last saw it. It is able to configure the vast majority of tailscales base featureset such as ACLs, magic DNS, taildrop file sharing, and so much more. Incredible.
- 369548684892826 4y ago
  Thanks for pointing this out, going to give it a whirl! Does this solve the thing about having to login using one of Google, Microsoft or Github accounts?
  - ratg13 4y ago
    You can use regular tailscale with an e-mail account.

deleted 4y ago

[deleted]

benmanns 4y ago

FYI when AWS had their little oopsie with the EC2 management APIs not too long ago, I couldn’t connect to an instance via Systems Manager. I also couldn’t adjust my security groups to enable SSH. I also couldn’t shut down the instance. AWS refused to provide any credits as their SLA only covers when the instances are not publicly accessible.

digianarchist 4y ago

We're using AWS SSM to allow access from a developer's machine to a locked down k8s cluster in AWS. It works but performance is awful. Slow connection times and pushing images has slow throughput.