Hacker News Reader

Comment by leg100 | Hacker News Reader

Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance:

  gcloud compute ssh <instance_name>

GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address.

[1]: https://cloud.google.com/compute/docs/instances/managing-ins...

[2]: https://cloud.google.com/iap/docs/using-tcp-forwarding

View on HN

Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM service and a websocket connection is established from the machine you need to remote into. A cool solution.

I assume it also logs the access in the SSM audit logs.

EC2 Connect is OSLogin-esque: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-inst...

I'm pretty sure this only works if you use images with Google's sauce added, which means your instances run Google daemons that do things like network, user, and ssh config.

Correct albeit no Google daemons, just OpenSSH server, PAM and NSS configurations:

https://cloud.google.com/compute/docs/oslogin/#how_os_login_...

That's good to know.

...But if you use an image with Google's sauce, there are Google daemons running on it, just not for this.

https://cloud.google.com/compute/docs/images/install-guest-e...

Reply on news.ycombinator.com