AWS Session Manager: less infrastructure, more features • Hacker News Board

Re: AWS Session Manager: less infrastructure, more features

#21

Post by hexadec » Mon, Mar 16, 2020, 5:49 PM UTC

derefr wrote: post #7

Are they basically trying to emulate GCP’s OS Login ( https://cloud.google.com/compute/docs/instances/managing-ins... ) feature here? We’ve been using that for a while, and it’s been a big relief.

It seems like a re-implementation of cloud shell for Azure (https://docs.microsoft.com/en-us/azure/cloud-shell/overview). It also uses the browser and native IAM, but you can use the native AD integration and JIT permissions.

But it seems no one like Azure these days, but they have some nifty features.

Re: AWS Session Manager: less infrastructure, more features

#22

Post by NikolaeVarius » Mon, Mar 16, 2020, 5:50 PM UTC

jcims wrote: post #13

IAM is easy to mess up. Would be interesting to lock down the session manager agent (if possible) so that the only way to privileged access is through sudo-like priv esc that uses 2fa.

Its fairly trivial to lock down AWS via a require MFA policy

Re: AWS Session Manager: less infrastructure, more features

#23

Post by peterwwillis » Mon, Mar 16, 2020, 5:57 PM UTC

It's great for managing active SSH sessions, but not so much for the other purpose for bastions: fine-grained network access control+routing. It would be cool if they made a more specific version of this just for network traffic without the SSH component.

Re: AWS Session Manager: less infrastructure, more features

#24

Post by gregmac » Mon, Mar 16, 2020, 6:52 PM UTC

I never see mention of Windows with Session Manager. I have a mixed infrastructure with a number of Windows (IIS) app servers running various things.

We currently connect via SSH to a bastionhost, then tunnel from there to various systems, which allows connecting to SSH (linux instances), RDP (Windows), or basically any other network services like Redis or a database. I ended up writing some scripts to automate all this, so as long as you have the right certificates and IAM permissions, you can connect with a single command -- for Windows instances, it even retrieves the randomized password from the EC2 API. The end result is for any EC2 instances you're instantly popped into a shell/RDP session without having to enter credentials.

I'd love to replace this with something better (eg Session Manager), but I've not seen how to do this for RDP, and haven't had the time to go experimenting on my own to see if it's even possible. If I can't 100% replace the bastionhosts, having two entirely different connection methods doesn't solve anything (and in fact makes it worse, because it's harder to use).

Re: AWS Session Manager: less infrastructure, more features

#25

Post by jcims » Mon, Mar 16, 2020, 7:04 PM UTC

NikolaeVarius wrote: post #22

jcims wrote: post #13

IAM is easy to mess up. Would be interesting to lock down the session manager agent (if possible) so that the only way to privileged access is through sudo-like priv esc that uses 2fa.

Its fairly trivial to lock down AWS via a require MFA policy

I'm talking about on the host, so if you mess up your IAM policy there is still an authorization layer on the host to get privileged access.

Re: AWS Session Manager: less infrastructure, more features

#26

Post by jbergknoff » Mon, Mar 16, 2020, 7:17 PM UTC

jcims wrote: post #25

NikolaeVarius wrote: post #22

Earlier quoted context omitted.

Its fairly trivial to lock down AWS via a require MFA policy

I'm talking about on the host, so if you mess up your IAM policy there is still an authorization layer on the host to get privileged access.

As far as I know, SSH over SSM doesn't do anything regarding user management. It just establishes an SSH connection. Management of users on the host, authorized SSH keys, etc. is totally out of scope for SSM.

So if you already have access control setup on your host, then SSM doesn't do anything to undermine it. If you don't have it, you'll still need to add it.

Re: AWS Session Manager: less infrastructure, more features

#27

Post by feydaykyn » Mon, Mar 16, 2020, 7:27 PM UTC

Does anyone know of it works with Ansible ? Thanks!

Re: AWS Session Manager: less infrastructure, more features

#28

Post by mishappen » Mon, Mar 16, 2020, 7:33 PM UTC

Be careful with SSM in general. The documentation suggests adding the AmazonEC2RoleforSSM policy to the role of the EC2 instances you want to access via Session Manager. This role grants read/write to all S3 buckets in your account (amongst other things). See this article for better steps and unavoidable risky things: https://cloudonaut.io/aws-ssm-is-a-trojan-horse-fix-it-now/

Re: AWS Session Manager: less infrastructure, more features

#29

Post by zokier » Mon, Mar 16, 2020, 7:36 PM UTC

idunno246 wrote: post #20

WaxProlix wrote: post #18

Earlier quoted context omitted.

You're right in a sense, but there's no aws-managed bastion. Session manager communicates with your instance via an outbound-created websocket connection. Inputs and outputs are piped through it.

yea, i was trying to keep things simplified, but it has to proxy through something behind the vpc endpoint. could also say its not technically ssh

Though you can actually get ssh through ssm: https://docs.aws.amazon.com/systems-manager/latest/userguide...

Re: AWS Session Manager: less infrastructure, more features

#30

Post by jon918 » Mon, Mar 16, 2020, 7:38 PM UTC

mishappen wrote: post #28

Be careful with SSM in general. The documentation suggests adding the AmazonEC2RoleforSSM policy to the role of the EC2 instances you want to access via Session Manager. This role grants read/write to all S3 buckets in your account (amongst other things). See this article for better steps and unavoidable risky things: https://cloudonaut.io/aws-ssm-is-a-trojan-horse-fix-it-now/

Good call to watch out for this stuff. The examples in the repo we set up use the AmazonSSMManagedInstanceCore managed policy, which does not grant any S3 permissions, just various ssm, ssmmessages, and ec2messages permissions.