Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

github.com

Post reply on HN
Print view View original

1–10 of 37 posts

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#4

Post by klohto »

Solving the SSH over SSM is sadly useless right now. The whole point of why we began using SSM was logging.

1) We soon discovered that using bash (and not sh that SSM signs you into) doesn’t format the logs correctly and makes them unreadable 2) Using SSH over SSM doesn’t log at all

Both of these problems are on AWS github but as always, they don’t respond.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#5

Post by sakisv »

It's hard to overstate how much of a difference this makes for managing people's access to servers without having to manage access keys. Especially if someone leaves the team/company you don't need to roll out new AMIs or run your puppet/ansible, it's just a `terraform apply` to update the IAM policy and you're done. Absolutely love it.

One thing that I found annoying through the web interface was the lousy support of special characters. Every now and then either some character combination or a big wall of text would make the browser-based terminal almost useless. I have yet to make time to configure the cli access which I don't think will have these issues.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#7

Post by vegardx »

You can also use ec2-instance-connect[0] to enable users to generate ephemeral keys that are valid for a few minutes, authenticated with IAM. The benefit is that it's all native after you've pushed your keys using either aws-cli or mssh.

It has more or less the same benefits that SSM has, and you can use the same method with ProxyCommand to establish authentication before connecting. You can also chain it using ProxyJump to use a bastion host. Wrapped in a tool like aws-vault you can quite easily work with 2FA and such.

[0] https://aws.amazon.com/about-aws/whats-new/2019/06/introduci...

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#8

Post by leg100 »

Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance:

  gcloud compute ssh
GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address.

[1]: https://cloud.google.com/compute/docs/instances/managing-ins...

[2]: https://cloud.google.com/iap/docs/using-tcp-forwarding

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#9

Post by ignoramous »

leg100 wrote: post #8

Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: gcloud compute ssh GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address. [1]: https://cloud.google.com/compute/docs/instances/managing-ins... [2]: https://cloud.g…

EC2 Connect is OSLogin-esque: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-inst...
Post reply on HN