Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emacs Tramp over AWS SSM APIs

martin.baillie.id

Post reply on HN
Print view View original

21–30 of 59 posts

Re: Emacs Tramp over AWS SSM APIs

#21

Post by staticassertion »

tyingq wrote: post #14

"Perhaps more interesting, though, is that for the last couple of years AWS has supported tunneling the SSH protocol over their SSM APIs if you use the SSM “document” called AWS-StartSSHSession." That's interesting. I know some places go to great lengths to keep developers from accessing production without some sort of break-glass procedure through a jump host. I'm curious if they all know about this sort of loophole…

SSM is much preferred to a jump host for a number of reasons.

1. You don't have to expose a jump host at all, which is one less exposed asset to manage and worry about.

2. Your security team should already be collecting Cloudtrail logs, so they get auditing of SSM/SSH "for free".

3. You can control SSM access via your SSO provider, which means you can trivially enforce a bunch of policies all in one place vs having to configure SSHD.

4. You can control SSM access via IAM.

5. You can limit session duration easily.

6. No more SSH agent hijacking, at least I don't think.

I also wouldn't call this a loophole, you have to explicitly have permissions to use SSM.

Re: Emacs Tramp over AWS SSM APIs

#22

Post by criddell »

taeric wrote: post #5
Scarbutt wrote: post #4

Earlier quoted context omitted.

vscode ate everyone's lunch in this department.

How? Tramp has been working at this level for well over a decade, if I'm not mistaken. And you don't have to have anything installed in the "host" that you are connecting to.

> How?

Microsoft has done a lot better job promoting VSCode than GNU has promoting Emacs for the past few years. More mindshare among influential developers / evangelists has lead to massive increases in adoption which leads to better extensions which in turn fuels more adoption.

It probably doesn't hurt that VSCode uses the MIT license.

Re: Emacs Tramp over AWS SSM APIs

#24

Post by ithrow »

criddell wrote: post #22
taeric wrote: post #5

Earlier quoted context omitted.

How? Tramp has been working at this level for well over a decade, if I'm not mistaken. And you don't have to have anything installed in the "host" that you are connecting to.

> How? Microsoft has done a lot better job promoting VSCode than GNU has promoting Emacs for the past few years. More mindshare among influential developers / evangelists has lead to massive increases in adoption which leads to better extensions which in turn fuels more adoption. It probably doesn't hurt that VSCode uses the MIT license.

The vscode remote plugin is developed by microsoft and it's closed source. I can see why, it gives them a competitive advantage over all rival IDEs.

Re: Emacs Tramp over AWS SSM APIs

#25

Post by cwyers »

ak217 wrote: post #11
natrys wrote: post #9

Earlier quoted context omitted.

Emacs isn't constrained by terminal, Tramp doesn't need knowing any "incredibly obscure" command, and since one uses local Emacs there is no input lag to speak of. I feel like you are conflating Emacs and Vi here even though they are not same at all, only in case of Vi you connect via ssh in a terminal and do everything remote side, not in Emacs. I use Tramp to have local Emacs connect to remote docker container, whe…

To be clear, I was only mentioning vi and emacs together because both have incredibly passionate communities that can be quite myopic to the UX deficiencies of their platforms. I have a lot of muscle memory committed to emacs so I still use it a lot, but I can onboard a dozen junior developers onto vscode in the time it takes me to help someone figure out emacs. And to me, the final missing piece that made vscode sui…

Yeah. Quitting vim has the most trafficked Stack Overflow page:

https://stackoverflow.blog/2017/05/23/stack-overflow-helping...

"Most people don't know how to use vim and emacs" is both incredibly controversial around these parts and totally true.

Re: Emacs Tramp over AWS SSM APIs

#26

Post by tyingq »

staticassertion wrote: post #21
tyingq wrote: post #14

"Perhaps more interesting, though, is that for the last couple of years AWS has supported tunneling the SSH protocol over their SSM APIs if you use the SSM “document” called AWS-StartSSHSession." That's interesting. I know some places go to great lengths to keep developers from accessing production without some sort of break-glass procedure through a jump host. I'm curious if they all know about this sort of loophole…

SSM is much preferred to a jump host for a number of reasons. 1. You don't have to expose a jump host at all, which is one less exposed asset to manage and worry about. 2. Your security team should already be collecting Cloudtrail logs, so they get auditing of SSM/SSH "for free". 3. You can control SSM access via your SSO provider, which means you can trivially enforce a bunch of policies all in one place vs having t…

>I also wouldn't call this a loophole, you have to explicitly have permissions to use SSM.

Perhaps not the best wording on my part. I was aware of SSM, but not aware of the SSH tunneling features. I'm wondering if that's common. Is the SSH tunneling controlled separately, or on by default if SSM is on?

Re: Emacs Tramp over AWS SSM APIs

#27

Post by ska »

dangom wrote: post #7
ak217 wrote: post #6

Earlier quoted context omitted.

Yes, the vscode remote development plugin is a game changer. It's the new benchmark for how client-server IDEs should work. I am (and more importantly, my team is) no longer constrained to the terminal and memorizing incredibly obscure emacs or vi commands to get stuff done on a remote instance. There is no input lag because vscode keeps all the IDE UI local while doing all the heavy lifting remotely. And to the arti…

I'd love to see a workflow comparison between emacs, vim (with remote work via neovim's tcp support + neovide) and vscode. I'm currently using Emacs and have a pretty decent setup for remote work with jupyter-emacs and tramp, and it's pretty much 0 overhead to run the same code on multiple remotes, or have the same remote run code stored in multiple places. With that said, all abstractions end if my SSH connection br…

> I'd love to see a workflow comparison between emacs, vim (with remote work via neovim's tcp support + neovide) and vscode.

To me, emacs is a great editor with variable quality IDE-like capabilities, highly dependent on workflow.

VScode is sort of the opposite. It's an at best ok editor with a strong suite of IDE capabilities that are mostly consistent.

Re: Emacs Tramp over AWS SSM APIs

#28

Post by wernerb »

staticassertion wrote: post #21
tyingq wrote: post #14

"Perhaps more interesting, though, is that for the last couple of years AWS has supported tunneling the SSH protocol over their SSM APIs if you use the SSM “document” called AWS-StartSSHSession." That's interesting. I know some places go to great lengths to keep developers from accessing production without some sort of break-glass procedure through a jump host. I'm curious if they all know about this sort of loophole…

SSM is much preferred to a jump host for a number of reasons. 1. You don't have to expose a jump host at all, which is one less exposed asset to manage and worry about. 2. Your security team should already be collecting Cloudtrail logs, so they get auditing of SSM/SSH "for free". 3. You can control SSM access via your SSO provider, which means you can trivially enforce a bunch of policies all in one place vs having t…

Installing Yet Another Agent on your cluster/VMS and ensuring they are updated while the SSM agent got an upgrade I believe from python to go it still does a lot more than just provide ssh sessions correct?

Re: Emacs Tramp over AWS SSM APIs

#29

Post by kstrauser »

ithrow wrote: post #20
taeric wrote: post #5

Earlier quoted context omitted.

How? Tramp has been working at this level for well over a decade, if I'm not mistaken. And you don't have to have anything installed in the "host" that you are connecting to.

Every time you save your edits Tramp makes a new connection to the remote server, it's slow(1sec vs 1ms) and becomes annoying waiting for the save all the time. For doing quick edits it doesn't matter but for doing dev all day it does.

Configuring OpenSSH's ControlMaster setting here makes an enormous difference. Summary: it keeps a connection open for a while in case you want to connect to the same machine again. If you do, it reuses that connection so the new one is nearly instant.

Re: Emacs Tramp over AWS SSM APIs

#30

Post by gumby »

staticassertion wrote: post #21
tyingq wrote: post #14

"Perhaps more interesting, though, is that for the last couple of years AWS has supported tunneling the SSH protocol over their SSM APIs if you use the SSM “document” called AWS-StartSSHSession." That's interesting. I know some places go to great lengths to keep developers from accessing production without some sort of break-glass procedure through a jump host. I'm curious if they all know about this sort of loophole…

SSM is much preferred to a jump host for a number of reasons. 1. You don't have to expose a jump host at all, which is one less exposed asset to manage and worry about. 2. Your security team should already be collecting Cloudtrail logs, so they get auditing of SSM/SSH "for free". 3. You can control SSM access via your SSO provider, which means you can trivially enforce a bunch of policies all in one place vs having t…

Also forgetting to quote ~ commands when going through a jump host leads to unexpected behavior — usually disconnection!
Post reply on HN