Did you get excited about the article “Did you know there is a better way to connect to your AWS Linux Instances than SSH”? Let’s have a look at how it is on a less theoretical level on this Teracloud article.
Ok, so you have created an i-fafafafafafafa AWS instance in your private subnet but for some reason, you need an SSH like connection to it to maybe use it hopefully not too often.
In the old days, having a bastion host used to be an acceptable choice. On these days, not so much. Basically because of the exposed ports. Even if you don’t use port 22 it is still a risk. Even an elementary school kid knows how to scan ports these days! Actually, my son does.
So the blog for today is about the SSM tool Amazon developed for us. You only need to have the agent running in your instance and set the AmazonSSMManagedInstanceCore policy to the role applied to the instance. With that, you will see a nice orange connect button in your web console.
But some people don’t feel comfortable with a console with web access. Sometimes you developed something I like to call the CTRL+w reflex to cut (or remove) the last word you wrote in bash, and if you do that in Firefox you will close your tab every time you press it rising you up that facepalm feeling and the “not again” internal thought. Therefore you need a real console.
Recalling the previous article you would have had the AWS-CLI v2 with an access key, secret id, and region installed in your box. So a simple aws ssm start-session — target i-fafafafafafafa would get you connected.
A nice trick for tryhards would be to set a bash alias like
alias CONN=’aws ssm start-session — target ‘
in your ~/.bash_aliases as a shortcut to typing only CONN i-fafafafafafafa and get into your instance.
Now, what if you need to transfer files between your Linux box and the instance? In that case, you need an extra step: You will need not only your AWS credentials as mentioned before, but the PEM (or RSA) key used when the instance was created, properly installed. Also, you need to configure your SSH to use SSM as a proxy by adding the following text at some point of your ~/.ssh/config file. Probably at the end of it.
host i-*
ProxyCommand bash -c “aws ssm start-session — target %h — document-name AWS-StartSSHSession — parameters ‘portNumber=%p’”
Once you have that, you will have SSH and SCP enabled to get your instance without exposing any port.
You can type commands like
ssh ec2-user@i-fafafafafafafa to get inside,
scp ec2-user@i-fafafafafafafa:/home/hello_world.py . to bring a file,
scp hello_world.py ec2-user@i-fafafafafafafa:/ to send a file, etc
Nice, isn’t it?
Just one more trick
Let’s imagine you do not need any file transfer feature, so the AWS SSM start-session method is enough. But you get into your console and you realize that some special keys don’t work. Hitting the arrows shows ^[[A, ^[[B, ^[[C and ^[[D; Home key shows ^[[H, End key shows ^[[F, etc when you try to move the cursor. Of course, you’d want your old console with magic tricks enabled! There is a very simple solution for that: type bash (enter).
You are welcome! :)
O’right! Now is the time to have fun and try it.
Stay around to learn more DevOps Blogs like this one.
Teracloud is an AWS Advanced Consulting Partner specialized in Cloud Computing (AWS, Azure, GCP) best practices. We help SaaS of different industries around the world scale their business safely.
Contact our team at info@teracloud.io for an assessment. Let us handle migration, automation, deployment, performance, cost optimization and machine learning to make your business grow.
We make the cloud easy for you!
