AWS Session Manager: less infrastructure, more features
1–10 of 49 posts
Re: AWS Session Manager: less infrastructure, more features
#2I'd love to learn how you're using Session Manager or what other features/integrations you'd like to see us explore. Also if the terraform module packaging is useful. There are additional Session Manager features like port forwarding that I plan to write about soon.
Re: AWS Session Manager: less infrastructure, more features
#3I'd love to learn how you're using Session Manager or what other features/integrations you'd like to see us explore. Also if the terraform module packaging is useful. There are additional Session Manager features like port forwarding that I plan to write about soon.
1. does it work with hardware tokens ?
we have some regulatory requirements that require us to use hardware tokens for 2FA access to servers.
2. what about SSH tunnels ?
Re: AWS Session Manager: less infrastructure, more features
#4I'd love to learn how you're using Session Manager or what other features/integrations you'd like to see us explore. Also if the terraform module packaging is useful. There are additional Session Manager features like port forwarding that I plan to write about soon.
Can you write one about port forwarding? Specifically, I would like to understand how various web interfaces on EMR cluster can be accessed through Sessions Manager. (Ganglia, Spark history server, etc.)
Re: AWS Session Manager: less infrastructure, more features
#5I'd love to learn how you're using Session Manager or what other features/integrations you'd like to see us explore. Also if the terraform module packaging is useful. There are additional Session Manager features like port forwarding that I plan to write about soon.
Can you write one about port forwarding? Specifically, I would like to understand how various web interfaces on EMR cluster can be accessed through Sessions Manager. (Ganglia, Spark history server, etc.)
Cool, will do!
Re: AWS Session Manager: less infrastructure, more features
#6I'd love to learn how you're using Session Manager or what other features/integrations you'd like to see us explore. Also if the terraform module packaging is useful. There are additional Session Manager features like port forwarding that I plan to write about soon.
1. does it work with hardware tokens ? we have some regulatory requirements that require us to use hardware tokens for 2FA access to servers. 2. what about SSH tunnels ?
It does work with hardware tokens, IF you get your AWS IAM credentials using a hardware token. If you're using AWS IAM users then here are instructions: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...
If you're doing a federated login with Okta or another provider, you need to set up the hardware MFA there.
There is SSH tunneling support as well, will add an update on that soon.
Re: AWS Session Manager: less infrastructure, more features
#7Are they basically trying to emulate GCP’s OS Login (https://cloud.google.com/compute/docs/instances/managing-ins...) feature here? We’ve been using that for a while, and it’s been a big relief.
Re: AWS Session Manager: less infrastructure, more features
#8Earlier quoted context omitted.
1. does it work with hardware tokens ? we have some regulatory requirements that require us to use hardware tokens for 2FA access to servers. 2. what about SSH tunnels ?
It does work with hardware tokens, IF you get your AWS IAM credentials using a hardware token. If you're using AWS IAM users then here are instructions: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti... If you're doing a federated login with Okta or another provider, you need to set up the hardware MFA there. There is SSH tunneling support as well, will add an update on that soon.
Our organization recently looked into AWS Session Manager for tunneling but couldn't find documentation on how to make it work for our usecase. We were trying to tunnel into our VPC in order to be able to connect to an Amazon DocumentDB cluster. We don't have any EC2 instances which seems to be the only thing Session Manager has support for. Despite the callouts that Session Manager replaces bastion servers, that didn't seem to be the case for us. Did we miss something in our research?
Re: AWS Session Manager: less infrastructure, more features
#9This is awesome! How can I install the the agent if I'm not using Amazon Linux?
Re: AWS Session Manager: less infrastructure, more features
#10Earlier quoted context omitted.
It does work with hardware tokens, IF you get your AWS IAM credentials using a hardware token. If you're using AWS IAM users then here are instructions: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti... If you're doing a federated login with Okta or another provider, you need to set up the hardware MFA there. There is SSH tunneling support as well, will add an update on that soon.
Our organization recently looked into AWS Session Manager for tunneling but couldn't find documentation on how to make it work for our usecase. We were trying to tunnel into our VPC in order to be able to connect to an Amazon DocumentDB cluster. We don't have any EC2 instances which seems to be the only thing Session Manager has support for. Despite the callouts that Session Manager replaces bastion servers, that did…
Last I checked the "tunneling" only works to redirect traffic to a different port on the same SSM managed instance. The tunnel cannot be established with another box in the same VPC. So I don't think you can call it tunneling until they add that feature. Here's the GitHub issue where they discuss the limitation and a workaround: https://github.com/aws/amazon-ssm-agent/issues/208