Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Down the rabbit hole: Implementing SSH port forwarding over AWS Session Manager

joinformal.com

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Down the rabbit hole: Implementing SSH port forwarding over AWS Session Manager

#11

Post by scarface_74 »

smackeyacky wrote: post #9
Galanwe wrote: post #7

Earlier quoted context omitted.

My variation is to use a custom script as `ProxyCommand` that resolves private route53 DNS names to instance ids, because remembering instance IDs is insane.

Mine is to run a Tailscale node on a tiny ec2 instance. Not only enabling ssh but direct access to database instances, s3 buckets that are blocked from public access etc

How are S3 buckets blocked from public access? I mean I know there is literally a “Block public access” feature that keeps S3 buckets from being read or written by unauthenticated users. But as far as I know without some really weird bucket ACLs you can still access S3 buckets if you have the IAM credentials.

Before anyone well actually’s me. Yes I know you can also route S3 via AWS internal network with VPC Endpoints between AWS services.

Re: Down the rabbit hole: Implementing SSH port forwarding over AWS Session Manager

#12

Post by Galanwe »

scarface_74 wrote: post #11
smackeyacky wrote: post #9

Earlier quoted context omitted.

Mine is to run a Tailscale node on a tiny ec2 instance. Not only enabling ssh but direct access to database instances, s3 buckets that are blocked from public access etc

How are S3 buckets blocked from public access? I mean I know there is literally a “Block public access” feature that keeps S3 buckets from being read or written by unauthenticated users. But as far as I know without some really weird bucket ACLs you can still access S3 buckets if you have the IAM credentials. Before anyone well actually’s me. Yes I know you can also route S3 via AWS internal network with VPC Endpoint…

You essentially add a policy that limits the access to only come from your VPC endpoint.

Re: Down the rabbit hole: Implementing SSH port forwarding over AWS Session Manager

#13

Post by nijave »

scarface_74 wrote: post #11
smackeyacky wrote: post #9

Earlier quoted context omitted.

Mine is to run a Tailscale node on a tiny ec2 instance. Not only enabling ssh but direct access to database instances, s3 buckets that are blocked from public access etc

How are S3 buckets blocked from public access? I mean I know there is literally a “Block public access” feature that keeps S3 buckets from being read or written by unauthenticated users. But as far as I know without some really weird bucket ACLs you can still access S3 buckets if you have the IAM credentials. Before anyone well actually’s me. Yes I know you can also route S3 via AWS internal network with VPC Endpoint…

In general, condition keys

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...

And https://docs.aws.amazon.com/service-authorization/latest/ref...

Specifically the vpce one as the other poster mentioned but there's other like IP limits

Another way is an IdP that supports network or device rules. For instance, Cloudflare Access and Okta you can add policies where they'll only let you auth if you meet device or network requirements which achieved the same thing

Re: Down the rabbit hole: Implementing SSH port forwarding over AWS Session Manager

#14

Post by nijave »

Was wondering if it's possible to use sshuttle with SSM but didn't realize SSM had its own mixing protocol.

An SSM client library is super helpful for embedding the tunneling into the client app. At a previous employer, we'd access jumphosts from AWS Session Manager and GCP Identity Aware Proxy and were looking to embed that connection flow into some cli management utilities to ease use. At the time, we ended up starting the tunneling processes separately inside the code but it would have been much nicer and easier with a library.

Re: Down the rabbit hole: Implementing SSH port forwarding over AWS Session Manager

#15

Post by icedchai »

smackeyacky wrote: post #9
Galanwe wrote: post #7

Earlier quoted context omitted.

My variation is to use a custom script as `ProxyCommand` that resolves private route53 DNS names to instance ids, because remembering instance IDs is insane.

Mine is to run a Tailscale node on a tiny ec2 instance. Not only enabling ssh but direct access to database instances, s3 buckets that are blocked from public access etc

I run an EC2 instance with SSM enabled. I then use the AWS CLI to port forward into the 'private' database instance or whatever from my desktop. The nice thing about this is it's all native AWS stuff, no need for 3rd party packages, etc.

Re: Down the rabbit hole: Implementing SSH port forwarding over AWS Session Manager

#16

Post by Galanwe »

nijave wrote: post #13
scarface_74 wrote: post #11

Earlier quoted context omitted.

How are S3 buckets blocked from public access? I mean I know there is literally a “Block public access” feature that keeps S3 buckets from being read or written by unauthenticated users. But as far as I know without some really weird bucket ACLs you can still access S3 buckets if you have the IAM credentials. Before anyone well actually’s me. Yes I know you can also route S3 via AWS internal network with VPC Endpoint…

In general, condition keys https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p... And https://docs.aws.amazon.com/service-authorization/latest/ref... Specifically the vpce one as the other poster mentioned but there's other like IP limits Another way is an IdP that supports network or device rules. For instance, Cloudflare Access and Okta you can add policies where they'll only let you auth if you meet devic…

> Specifically the vpce one as the other poster mentioned but there's other like IP limits

IPs don't cut it to prevent public access. I can create my own personal AWS account, with the private IP I want, and use the credentials from there. There's really just VPC endpoints AFAIK.

Post reply on HN