Skip to content

README.windows.md

Latest commit

 

History

History
80 lines (59 loc) · 4.31 KB

README.windows.md

File metadata and controls

80 lines (59 loc) · 4.31 KB
Raw

aws-ssm-ec2-proxy-command (Windows)

Open an SSH connection to your ec2 instances via AWS SSM without the need to open any ssh port in you security groups.

ⓘ Unix users please refere to README.md

Prerequisits

Install SSH Proxy Command

Unfortunately on Windows is not possible to show output while running ProxyCommand, script output is interpreted as SSH banner which is available with SSH verbose options.

Setup SSH Config [optional]
  • Add ssh config entry for aws ec2 instances to your ~/.ssh/config. Adjust key file path if needed.
host i-* mi-*
  IdentityFile ~/.ssh/id_rsa
  ProxyCommand powershell.exe ~/.ssh/aws-ssm-ec2-proxy-command.ps1 %h %r %p ~/.ssh/id_rsa.pub
  StrictHostKeyChecking no

Open SSH Connection

  • Ensure AWS CLI environemnt variables are set properly e.g.
    • export AWS_PROFILE=default or AWS_PROFILE=default ssh ... <INSTACEC_USER>@<INSTANCE_ID>
  • If default region does not match instance region you need to provide it
    • e.g. <INSTACEC_USER>@<INSTANCE_ID>--<INSTANCE_REGION>
SSH Command with SSH Config Setup

ssh.exe <INSTACEC_USER>@<INSTANCE_ID>

  • e.g. ssh.exe ec2-user@i-1234567890
SSH Command with ProxyCommand CLI Option
ssh.exe <INSTACEC_USER>@<INSTANCE_ID> `
-i "~/.ssh/id_rsa" `
-o ProxyCommand="powershell.exe ~/.ssh/aws-ssm-ec2-proxy-command.ps1 %h %r %p ~/.ssh/id_rsa.pub"

Alternative Implementation with ec2-instance-connect

The advantage from security perspective it that you don't need to grant ssm:SendCommand to users and there by the permission to execute everything as root. Instead you only grant ec2-instance-connect:SendSSHPublicKey permission to a specific instance user e.g. ec2-user.