Hacker News Reader

Comment by xomodo | Hacker News Reader

For accessing aws ec2 instances behind nat/fw add this lines ~/.ssh/config:

  Host i-* mi-*
   ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
   UserKnownHostsFile /dev/null
   StrictHostKeyChecking no
   User ubuntu
   LogLevel ERROR
   DynamicForward 5060

Usage: `ssh -i key.pem i-0xxxxxxxxxx`. Last config line can be used for optional proxy browsing.

View on HN

This is a game changer. I have a bastion host in certain environments I never realized AWS has built in kit to achieve this sort of thing. I assume the key product here is SSM?

Correct. It’s not always this simple though, you also need an IAM profile that the EC2 instance can assume with the required permissions. Depending on how you configure your NAT Instance/Gateway, you may also need to whitelist the ssm service.

Im using this IAM policy on ec2 instance profile: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"

Reply on news.ycombinator.com