AWS Session Manager

Reference

https://github.com/elpy1/ssh-over-ssm

This page describes the tools and steps needed to configure Session Manager to be able to connect to AWS resources (and DB) from local machine.

Client Side

  1. Install the AWS CLI
  2. Configure the AWS CLI with your IAM user credentials
  3. Install the Session Manager plugin for AWS CLI
  4. Download the SSH over SSM script
  5. Change permission of the script and move it to bin folder
sudo chmod +x ssh-ssm.sh
sudo mv ssh-ssm.sh /usr/local/bin
  1. Update SSH config (~/.ssh/config)
### Server
Host server1
  HostName i-abc
  User ubuntu
  ProxyCommand bash -c "/usr/local/bin/ssh-ssm.sh %h %r"

### DB 
Host pgpool
  Hostname i-xyz
  User ubuntu
  ProxyCommand bash -c "/usr/local/bin/ssh-ssm.sh %h %r"
  LocalForward 10001 localhost:5432
  ServerAliveInterval 60

### Need for SSH forwawrding over SSM
Match Host i-*
  IdentityFile ~/.ssh/ssm-ssh-tmp
  StrictHostKeyChecking no
  BatchMode yes
  1. Test the connection

MFA Authentication for CLI

https://levelup.gitconnected.com/aws-cli-automation-for-temporary-mfa-credentials-31853b1a8692

https://github.com/asagage/aws-mfa-script

Server Side Configuration

  1. Ensure that SSM agent is installed in EC2 instance. SSM agent is installed by default in AWS Ubuntu AMI & Amazon Linux AMI
  2. Ensure that the EC2 servers have the GenericServerRoleForEC2 IAM role attached which will allow the servers to connect to Systems Manager services

IAM configuration

Reference

https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-restrict-access-examples.html#restrict-access-example-instances

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html#ssh-connections-permissions

In order to allow / restrict access on who can connect to the EC2 instances via Session Manager, IAM policies can be created.

Example policy to allow to connect to a set of servers. The instance list needs to be updated if there are new servers added

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ssm:StartSession",
            "Resource": [
                "arn:aws:ec2:*:*:instance/i-abc",
                "arn:aws:ec2:*:*:instance/i-def",
                "arn:aws:ec2:*:*:instance/i-xyz",
                "arn:aws:ssm:*:*:document/AWS-StartSSHSession"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/i-abc",
                "arn:aws:ec2:*:*:instance/i-def",
                "arn:aws:ec2:*:*:instance/i-xyz",
                "arn:aws:ssm:*:*:document/AWS-RunShellScript"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "ssm:GetCommandInvocation",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:ResumeSession",
                "ssm:TerminateSession"
            ],
            "Resource": "arn:aws:ssm:*:*:session/${aws:username}-*"
        }
    ]
}