See documentation here.ĪWS provides the following lines you can add to your ~/.ssh/config file to facilitate easily connecting to SSH over a SSM port forwarding. Now you can use SSM to port forward to port 22 on the EC2 instance and then connect via SSH over the SSM connection, but you will still need to manage the keypair for the instance(s). I can then use my favorite local MySQL client to connect to the database without any problems.

A common use case for SSH port forwarding (that I’ve used myself) is connecting to a relational database that is not directly accessible from my development machine. In addition to allowing shell access, Session Manager provides port-forwarding to ports on the instance you are connecting to however, it does not provide any other port forwarding features like SSH does. Unfortunately Session Manager is not a complete drop-in replacement for traditional SSH. You can manage shell access to the instances just like you manage your other IAM permissions. Session Manager is a great solution to many of the problems with traditional SSH access since you no longer need to manage SSH keys on the instances since authentication is handled through IAM. The instance just needs access to the Session Manager api via public internet, NAT gateway, VPC interface, etc. The Session Manager backend in AWS land relays messages between the operator and the instance. AWS Systems Manager Session ManagerĪWS provides a service, Systems Manager Session Manager which, using an agent running on the EC2 instance and an IAM role attached to the instances, allows shell access to the instance without a direct network path between the operator and the instance or SSH running on the instance. Not ideal! Fortunately, there are some AWS services that can come to your rescue. Also, you'll need to manage the SSH keys on the instances as your employees and contractors come and go. In addition to one key per person, you'll need a network path from the sys admin to the ec2 instance (public IP address on the EC2 instance, with IP restrictions on incoming connection, VPN connection to the VPC, etc). You should have one ssh key per system admin, since sharing credentials is a bad security practice. But when it comes time to put workloads into production on EC2 SSH keys don't scale well. This works fine for adhoc testing, prototyping, etc. You just need to start the instance with a public key for which you have the corresponding private key. Industrial Machine Connectivity/Connected FactoryĪWS Systems Manager Sessions Manager + EC2 Instance Connect = AwesomeĪWS provides several ways to gain shell access to running ec2 instances.AWS MAP (Migration Acceleration Program).Amazon Elastic Kubernetes Service (EKS).

Ssm session manager