Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emacs Tramp over AWS SSM APIs

martin.baillie.id

Post reply on HN
Print view View original

31–40 of 59 posts

Re: Emacs Tramp over AWS SSM APIs

#31

Post by hashkb »

cwyers wrote: post #25
ak217 wrote: post #11

Earlier quoted context omitted.

To be clear, I was only mentioning vi and emacs together because both have incredibly passionate communities that can be quite myopic to the UX deficiencies of their platforms. I have a lot of muscle memory committed to emacs so I still use it a lot, but I can onboard a dozen junior developers onto vscode in the time it takes me to help someone figure out emacs. And to me, the final missing piece that made vscode sui…

Yeah. Quitting vim has the most trafficked Stack Overflow page: https://stackoverflow.blog/2017/05/23/stack-overflow-helping... "Most people don't know how to use vim and emacs" is both incredibly controversial around these parts and totally true.

What's controversial? That people who say they know vim actually don't?

Re: Emacs Tramp over AWS SSM APIs

#32

Post by gumby »

xemdetia wrote: post #16
ak217 wrote: post #6

Earlier quoted context omitted.

Yes, the vscode remote development plugin is a game changer. It's the new benchmark for how client-server IDEs should work. I am (and more importantly, my team is) no longer constrained to the terminal and memorizing incredibly obscure emacs or vi commands to get stuff done on a remote instance. There is no input lag because vscode keeps all the IDE UI local while doing all the heavy lifting remotely. And to the arti…

I'm confused with claiming obscure emacs or vi commands for TRAMP, I'm from the emacs side and as soon as I understood the file path scheme (e.g.: /ssh:$host:/path/to/file) I didn't have to do anything beyond that. I would say that the dev client/server setup you're describing and what TRAMP provides are different things overall as well. TRAMP really just provides a way to get a file from a remote, edit it locally, a…

Definitely.

Trivia: the original Emacs (written in TECO for PDP-10s running ITS) also had transparent access to remote filesystems using the same syntax (host:path).

It was free though: remote files were accessed over the net via a FUSE-like userspace process.

In the mid 1970s.

Re: Emacs Tramp over AWS SSM APIs

#33

Post by awsthro00945 »

tyingq wrote: post #26
staticassertion wrote: post #21

Earlier quoted context omitted.

SSM is much preferred to a jump host for a number of reasons. 1. You don't have to expose a jump host at all, which is one less exposed asset to manage and worry about. 2. Your security team should already be collecting Cloudtrail logs, so they get auditing of SSM/SSH "for free". 3. You can control SSM access via your SSO provider, which means you can trivially enforce a bunch of policies all in one place vs having t…

>I also wouldn't call this a loophole, you have to explicitly have permissions to use SSM. Perhaps not the best wording on my part. I was aware of SSM, but not aware of the SSH tunneling features. I'm wondering if that's common. Is the SSH tunneling controlled separately, or on by default if SSM is on?

It is "on" by default, but the user still has to have the 'ssm:StartSession' permission (and probably others) to open the SSM session, and for some(?) operations you also still need to have the appropriate credentials (ssh keypair or a password) to login via SSH.

SSM Session Manager is one of the (if not the) preferred way to manage SSH access to instances in AWS. It's kinda hairy to set up, but it removes the need for bastion hosts/jump boxes for most use cases. From my experience I would say it is quite common.

Re: Emacs Tramp over AWS SSM APIs

#34

Post by throwawayboise »

thamer wrote: post #15

TIL: TRAMP (Transparent Remote Access, Multiple Protocols) is a package for editing remote files [...] Whereas the others use FTP to connect to the remote host and to transfer the files, TRAMP uses a remote shell connection (rlogin, telnet, ssh). https://www.emacswiki.org/emacs/TrampMode

Tramp can use FTP if you tell it to.

And it's still transferring files. It's not remotely editing.

Re: Emacs Tramp over AWS SSM APIs

#35

Post by throwawayboise »

ak217 wrote: post #11
natrys wrote: post #9

Earlier quoted context omitted.

Emacs isn't constrained by terminal, Tramp doesn't need knowing any "incredibly obscure" command, and since one uses local Emacs there is no input lag to speak of. I feel like you are conflating Emacs and Vi here even though they are not same at all, only in case of Vi you connect via ssh in a terminal and do everything remote side, not in Emacs. I use Tramp to have local Emacs connect to remote docker container, whe…

To be clear, I was only mentioning vi and emacs together because both have incredibly passionate communities that can be quite myopic to the UX deficiencies of their platforms. I have a lot of muscle memory committed to emacs so I still use it a lot, but I can onboard a dozen junior developers onto vscode in the time it takes me to help someone figure out emacs. And to me, the final missing piece that made vscode sui…

The UX is 90% a matter of what you know and what you are familiar with coming in.

I had to figure out how to do rectangular copy/paste in vscode, and it took just as long as it did to figure it out in emacs.

Re: Emacs Tramp over AWS SSM APIs

#36

Post by staticassertion »

wernerb wrote: post #28
staticassertion wrote: post #21

Earlier quoted context omitted.

SSM is much preferred to a jump host for a number of reasons. 1. You don't have to expose a jump host at all, which is one less exposed asset to manage and worry about. 2. Your security team should already be collecting Cloudtrail logs, so they get auditing of SSM/SSH "for free". 3. You can control SSM access via your SSO provider, which means you can trivially enforce a bunch of policies all in one place vs having t…

Installing Yet Another Agent on your cluster/VMS and ensuring they are updated while the SSM agent got an upgrade I believe from python to go it still does a lot more than just provide ssh sessions correct?

I don't really know much about the agent. I'm not super concerned with keeping it updated though.

Re: Emacs Tramp over AWS SSM APIs

#37

Post by gunapologist99 »

> For a good wee while now, AWS SSM (or AWS Systems Manager as I see they are calling it nowadays) has arguably been the most secure way to permit controlled and audited access to an EC2 instance.

SSM is definitely not the most secure way[0]. SSM is super complex and super-integrated into the rest of AWS, and also isn't cross-cloud to GCP, Azure, DO, etc, so now everyone needs an account just to log into a Linux server.

Worse, IAM roles are powerful but easy to misconfigure, and that's before getting into how hard they are to apply with any granularity because of the policy length limitations[1], so you're likely giving everyone access to log into every instance without even knowing it.

0. https://cloudonaut.io/aws-ssm-is-a-trojan-horse-fix-it-now/

1. https://aws.amazon.com/premiumsupport/knowledge-center/iam-i...

Re: Emacs Tramp over AWS SSM APIs

#38

Post by narrator »

tyingq wrote: post #14

"Perhaps more interesting, though, is that for the last couple of years AWS has supported tunneling the SSH protocol over their SSM APIs if you use the SSM “document” called AWS-StartSSHSession." That's interesting. I know some places go to great lengths to keep developers from accessing production without some sort of break-glass procedure through a jump host. I'm curious if they all know about this sort of loophole…

Accessing production on the command line is an anti-pattern. I can only think of one good reason to do it: If one is investigating a security incident where a hacker has broken into production and screwed around. Even then, one would want to snapshot the instance and take it offline to investigate it.

If there's some tricky bug in production, then one can create some sort of debugging service that runs on another port and deploy it to investigate the bug, or use management and monitoring tools. Copying files up to production is something that should be only done by an automated deployment script.

Re: Emacs Tramp over AWS SSM APIs

#39

Post by [deleted] »

forty wrote: post #8
ak217 wrote: post #6

Earlier quoted context omitted.

Yes, the vscode remote development plugin is a game changer. It's the new benchmark for how client-server IDEs should work. I am (and more importantly, my team is) no longer constrained to the terminal and memorizing incredibly obscure emacs or vi commands to get stuff done on a remote instance. There is no input lag because vscode keeps all the IDE UI local while doing all the heavy lifting remotely. And to the arti…

You seem to imply that using vi or emacs is an inferior UX than using VSCode (as it's a constraint), but I'm sure many people people feel differently (me included, and I have used VSCode as my main ide for a while).

[deleted]

Re: Emacs Tramp over AWS SSM APIs

#40

Post by Scarbutt »

kstrauser wrote: post #29
ithrow wrote: post #20

Earlier quoted context omitted.

Every time you save your edits Tramp makes a new connection to the remote server, it's slow(1sec vs 1ms) and becomes annoying waiting for the save all the time. For doing quick edits it doesn't matter but for doing dev all day it does.

Configuring OpenSSH's ControlMaster setting here makes an enormous difference. Summary: it keeps a connection open for a while in case you want to connect to the same machine again. If you do, it reuses that connection so the new one is nearly instant.

I'll give it a try, thanks.
Post reply on HN