Using AWS Session Manager with enhanced SSH and SCP capability to connect to your EC2 without using firewalls and bastion hosts
Amazon Web Services recently announced new capabilities in the AWS Systems Manager Session Manager. Users are now capable of tunneling SSH (Secure Shell) and SCP (Secure Copy) connections directly from a local client without the need for the AWS management console.
For years, users have relied on firewalls and bastion hosts in order to securely access cloud assets, but these options have security and management overhead tradeoffs. The Session Manager allows for secure, audited console access to cloud resources without the need for additional ingress points.
Local Prerequisites
In order to perform SCP and SSH operations from your local host to the remote cloud asset, you will need to perform the following setup steps on your client.
Install the latest AWS CLI
Update to the latest AWS CLI – An updated command line interface is required on your local host in order to use these new Session Manager features. The version of the AWS CLI should be at least 1.16.213.
How to get the version: aws --version
Install the Session Manager Plugin
Install the Session Manager Plugin – This plugin allows the AWS cli to launch Session Manager sessions with your local SSH client. The Version should be should be at least 1.1.26.0.
How to get the version: session-manager-plugin --version
Update local host SSH config
The tricky portion of this setup involves altering your local host SSH configuration in order to proxy commands through the AWS session manager for any aws ec2 instance-id.
- Download AWS SSM SSH ProxyCommand
- Move this script to
~/.ssh/aws-ssm-ec2-proxy-command.sh - Make it executable
chmod +x ~/.ssh/aws-ssm-ec2-proxy-command.sh - Add following entry to your
~/.ssh/config
host i-* mi-*
ProxyCommand ~/.ssh/aws-ssm-ec2-proxy-command.sh %h %r %p
EC2 Prerequisites
You will need to perform the following setup steps on your target EC2 instance.
Instance Profile
By default, AWS Systems Manager doesn't have permission to perform actions on your instances. You must grant access by using an AWS Identity and Access Management (IAM) instance profile. An instance profile is a container that passes IAM role information to an Amazon Elastic Compute Cloud (Amazon EC2) instance at launch. You need to add SSM permission to your Instance Profile
SSM Agent
Ensure the latest SSM Agent on Target Instance
yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
service amazon-ssm-agent restart
Firewall Configuration
Ensure the security group allow outbound to System Manager. No inbound ssh port is required.
Usage
Once these steps are complete, you will be ready to initiate SSH and SCP connections to your cloud assets directly from your local machine.
Obtain the instance-id of the cloud asset. This can be done via the AWS management console or with the AWS cli command aws ec2 describe-instances, and will have a format similar to i-0ba3d05e2b6c0fb36
SSH can be performed as normal using the instance-id as the hostname. Most SSH command line switches can be used such as using a key in the following example:
export AWS_PROFILE='default'
ssh ec2-user@i-0ba3d05e2b6c0fb36
These connections are secured by IAM access and generate cloudtrail events for logging and monitoring.
While immutable infrastructure is a desired goal for multiple reasons, many will find themselves with a need to access or alter systems running live. The AWS Systems Manager Session Manager allows this capability without the need for additional firewall ingress or bastion hosts.
Update: Use SSO with AWS CLI v2 to connect to EC2 over SSH using SSM
Prerequistes
- Install and configure AWS CLI v2
- Install the Session Manager Plugin
Login via SSO - AWS CLI v2 to connect to an EC2 over SSH using SSM
Update local host SSH config
- Add following entry to your
~/.ssh/config
# SSH over Session Manager
host i-* mi-*
IdentityFile ~/.ssh/id_rsa
ProxyCommand ~/.ssh/aws-ssm-ec2-proxy-command.sh %h %r %p ~/.ssh/id_rsa.pub
StrictHostKeyChecking no
Usage
Login to AWS SSO
aws2 sso login --profile defaultExport AWS_PROFILE
export AWS_PROFILE='default'SSH into your instance by using the following command.
ssh -i /path/my-key-pair.pem ec2-user@instance-id
Top comments (2)
Hi David, great article. The method you describe here is definitely the easiest and the one that feels the most familiar. The downside of both using SCP and SSH with Session manger is this note from AWS:
Personally, that’s not functionally I want to loose using Session Manager, the tradeoff is indeed some extra complexity. It’s a personal choice of course. I just wanted to mention it. I’ve written my opinion down in my own blog post on this platform ( although I’m not going to add a shameless plug 😄 )
Ooh, thanks for calling that out