Prox圜ommand sh -c 'aws ssm start-session -target %h -document-name AWS-StartSSHSession -parameters 'portNumber=%p'' Without ever exposing SSH via ingress security group rules.Īdd the following host configuration to your ssh config: ~/.ssh/config: host i-* mi-* From there you can leverage all the things you would expect via SSH like ssh-agent forwarding, etc. Transport to reach the EC2 instance, then leverages the SSH on loopback, and SSH authentication (SSH key on our case)įor access. Session Manager is a AWS Systems Manager capability that allows to manage EC2 instances, on-premises instances, and virtual machines (VMs) through an. Session Manager can also be combine with SSH via the proxy functionality in SSH. Please refer to SessionManager Documentation here: $ aws ssm start-session -target i-0123456789abcdefg You’ll receive the following error if you don’t have Session Manager Plugin installed or correctly configured.Need a minimum egress HTTPS (port 443) to: Because the ssm-agent running on the instance has to establish a connection with the SSM service in AWS it will.It’s a good idea to have alternative modes of connectivity (OpenSSH) into the EC2 instance while iterating on We noticed ssm-agent wasn’t always honoring our policy changes after we updated them: Restarting the rvice after adjusting your policy to verify that the ssm-agent is make use of the If you find yourself wanting to iterate on these IAM policies with a live EC2 instance, we highly recommend.Linux mu 6.1.19 #1-NixOS SMP PREEMPT_DYNAMIC Mon Mar 13 09:21: x86_64 GNU/LinuxĪwesome, the connection was successful with our trimmed down IAM policy! Troubleshooting (On Linux and macOS machines, this account is added to /etc/sudoers/.) If you choose, you can instead authenticate sessions using the credentials of an operating system (OS) user account. Starting session with SessionId: josh-0123456789abcdefg By default, Session Manager authenticates connections using the credentials of the system-generated ssm-user account that is created on a managed node.

Then establish the connection with the remote EC2 instance: $ aws ssm start-session -target i-0123456789abcdefg $ nix shell nixpkgs#awscli2 nixpkgs#ssm-session-manager-plugin Policy down to just 5 actions for a standard remote shell: After some troubleshooting and comparing our findings with some other sources online we were able to trim the We decided to go digging to see what exact actions were needed in the IAM instance profile to allow a shell via Session So what is the bare minimum that would meet our needs for remote access? Trimmed Down IAM Policy Granting remote shell access via ssm-agent. This policy contains a ton of actions that are unnecessary when only The AWS Systems Manager service is able to provide. The above policy seems to be a generic one that encompasses

Ssm session manager