Amazon Web Services recently announced new capabilities in the AWS Systems Manager Session Manager. Users are now capable of tunneling SSH (Secure Shell) and SCP (Secure Copy) connections directly from a local client without the need for the AWS management console.
For years, users have relied on firewalls and bastion hosts in order to securely access cloud assets, but these options have security and management overhead tradeoffs. The Session Manager allows for secure, audited console access to cloud resources without the need for additional ingress points.
In order to perform SCP and SSH operations from your local host to the remote cloud asset, you will need to perform the following setup steps on your client.
Update to the latest AWS CLI – An updated command line interface is required on your local host in order to use these new Session Manager features. The version of the AWS CLI should be at least 1.16.213.
How to get the version:
Install the Session Manager Plugin – This plugin allows the AWS cli to launch Session Manager sessions with your local SSH client. The Version should be should be at least 18.104.22.168.
How to get the version:
The tricky portion of this setup involves altering your local host SSH configuration in order to proxy commands through the AWS session manager for any aws ec2 instance-id.
chmod +x ~/.ssh/aws-ssm-ec2-proxy-command.sh
host i-* mi-* ProxyCommand ~/.ssh/aws-ssm-ec2-proxy-command.sh %h %r %p
You will need to perform the following setup steps on your target EC2 instance.
By default, AWS Systems Manager doesn't have permission to perform actions on your instances. You must grant access by using an AWS Identity and Access Management (IAM) instance profile. An instance profile is a container that passes IAM role information to an Amazon Elastic Compute Cloud (Amazon EC2) instance at launch. You need to add SSM permission to your Instance Profile
Ensure the latest SSM Agent on Target Instance
yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm service amazon-ssm-agent restart
Ensure the security group allow outbound to System Manager. No inbound ssh port is required.
Once these steps are complete, you will be ready to initiate SSH and SCP connections to your cloud assets directly from your local machine.
Obtain the instance-id of the cloud asset. This can be done via the AWS management console or with the AWS cli command
aws ec2 describe-instances, and will have a format similar to
SSH can be performed as normal using the instance-id as the hostname. Most SSH command line switches can be used such as using a key in the following example:
export AWS_PROFILE='default' ssh ec2-user@i-0ba3d05e2b6c0fb36
These connections are secured by IAM access and generate cloudtrail events for logging and monitoring.
While immutable infrastructure is a desired goal for multiple reasons, many will find themselves with a need to access or alter systems running live. The AWS Systems Manager Session Manager allows this capability without the need for additional firewall ingress or bastion hosts.
Update local host SSH config
# SSH over Session Manager host i-* mi-* IdentityFile ~/.ssh/id_rsa ProxyCommand ~/.ssh/aws-ssm-ec2-proxy-command.sh %h %r %p ~/.ssh/id_rsa.pub StrictHostKeyChecking no
aws2 sso login --profile default
ssh -i /path/my-key-pair.pem ec2-user@instance-id