,
9 tweets,
4 min read
Read on Twitter
Very cool new feature to SSH into ec2 instances via IAM:
aws.amazon.com/about-aws/what…
Connect in the console or via CLI:
$ aws s3 cp s3://ec2-instance-connect/cli/ec2instanceconnectcli-latest.tar.gz .
$ pip install ec2instanceconnectcli-latest.tar.gz
$ mssh instanceid
aws.amazon.com/about-aws/what…
Connect in the console or via CLI:
$ aws s3 cp s3://ec2-instance-connect/cli/ec2instanceconnectcli-latest.tar.gz .
$ pip install ec2instanceconnectcli-latest.tar.gz
$ mssh instanceid
Link to docs: docs.aws.amazon.com/AWSEC2/latest/…
Automatically setup on amazon linux 2 - can be installed on other machines:
$ sudo yum install ec2-isntance-connect
Automatically setup on amazon linux 2 - can be installed on other machines:
$ sudo yum install ec2-isntance-connect
IAM policies can set which users/roles can login to which instances:
[
{"Effect": "Allow",
"Action": "ec2-instance-connect:SendSSHPublicKey",
"Resource": "arn:aws:ec2:rgn:id:instance/instance-id",
"Condition": { "StringEquals": { "ec2:osuser": "ami-username"}}}
]
[
{"Effect": "Allow",
"Action": "ec2-instance-connect:SendSSHPublicKey",
"Resource": "arn:aws:ec2:rgn:id:instance/instance-id",
"Condition": { "StringEquals": { "ec2:osuser": "ami-username"}}}
]
Also, all connection requests are logged to cloudtrail so you can audit them! You could send an SNS anytime someone logs in as a sudoer: docs.aws.amazon.com/AWSEC2/latest/…
and a shoutout to @AnshumaliPrasad one of the core developers on this project:
Forum post: forums.aws.amazon.com/ann.jspa?annID…
You have to open port 22 to the EC2_INSTANCE_CONNECT prefixes listed here - ip-ranges.amazonaws.com/ip-ranges.json
Check out this tool that @__steele made for just using regular ssh with a proxy command: github.com/glassechidna/e…
