2 ms·
Hah. I did pretty much all the same stuff in my previous company. One thing that we did a bit better: we used AWS SSM to provision our SSH-CA certificates onto
by cyberax 2y ago
Hah. I did pretty much all the same stuff in my previous company.
One thing that we did a bit better: we used AWS SSM to provision our SSH-CA certificates onto the running AWS EC2 instances during the first connection.
It would be even better if AWS allowed to use SSH CA certs as keys, but alas...
- pugz 2y agoFYI I love your work with Gimlet, etc. I too would love "native" support for SSH CAs in EC2. What I ended up doing is adding a line to every EC2 userdata script that would rewrite the /home/ec2-user/.ssh/authorized_keys file to treat the provided EC2 keypair as a CA instead of a regular pubkey.