Network Security: Set up SSM for SSH Access
We'll cover the following
In this section, we’re going to make our EC2 instances inaccessible from the internet. The instances will be able to reach the internet using a NAT gateway, but the network will not allow anything from the internet to reach the instances without going through the load balancer.
🔍 Once we make our instances use a NAT gateway to connect to the internet, an additional data transfer charge (currently $0.045/GB in us-east-1) will apply to all traffic that transits the gateway. This includes traffic to other AWS services.
NOTE: It is very important to note that the prices mentioned above are only for the purpose of understanding cost comparisons. These prices are subject to change anytime by AWS. Therefore, most current prices should be referenced for final business decisions.
To avoid the extra charge, most AWS services can be configured to expose an endpoint that doesn’t pass through the internet. This can be done via Gateway VPC Endpoints or Interface VPC Endpoints (AWS PrivateLink).
Set up SSM for SSH access#
One thing that won’t work after we lock down our hosts is EC2 Instance Connect. In order to acquire SSH access to our instances, we’ll have to use AWS Systems Manager Session Manager (SSM).
Let’s start by adding two new managed policies to the IAM role used by our instances.
Line #15 and #16: New policies required to allow SSM access.
Let’s check it in, and deploy.
Note: All the code has been already added and we are pushing it on our repository as well.
/
- deploy-infra.sh
To connect from our local terminal, we can install the SSM plugin for the AWS CLI while the CloudFormation changes are deploying.
🔍 Sometimes it can take a while for the updated IAM role to take effect on instances that are already running. If your instances are failing to connect via SSM, you can try terminating your instances and letting the ASG replace them with fresh ones.
We should now be able to open a shell on a remote host with the AWS CLI. Once the connection goes through, we are connected as ssm-user, not our familiar ec2-user. So before we do anything else, we must switch to ec2-user and change into the appropriate home directory.
Line #1: Replace i-07c5a5b5907d43ca7 with an instance ID from your fleet.
We can also continue to use the AWS console to SSH to our instances. But now we have to choose Session Manager instead of EC2 Instance Connect.
In the next lesson, we will add private subnets and NAT Gateway for our application.
