terraform-ecs icon indicating copy to clipboard operation
terraform-ecs copied to clipboard

Published 20 hours ago • verified publisher icon arminc

AWS remote commands

Open arminc opened this issue 8 years ago • 4 comments

Don't use SSH but use AWS remote commands to execute commands on the instances. This is more secure and beter audited. http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ec2-run-command.html

arminc avatar May 23 '17 18:05 arminc

Hi! Could you, please, help me in the following question. I need to debug why my application does not start on EC2 instance in ECS (I use this repository for deploy infrastructure). What should I do better? For AWS remote commands I also should use SSH. I need to assign elastic ip, allow ssh in security groups, etc? Thanks

denishonig avatar Oct 09 '17 11:10 denishonig

@denishonig You can create a bastion host and give it access to the EC2 nodes on port 22 that way you can tunnel the SSH connection from your bastion host to your EC2 node.

Your PC -> bastion -> EC2 node for ECS

arminc avatar Oct 09 '17 12:10 arminc

Another way to access EC2 is to use AWS SessionManager https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html.

dtphuc avatar Oct 13 '20 13:10 dtphuc

Another way to access EC2 is to use AWS SessionManager https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html.

This is the method that I prefer. It requires setting up AWS Systems Manager, which I've found a bit futsy, but which seems to be getting better:

  • Quick start here: https://console.aws.amazon.com/systems-manager/home?region=us-east-1# (be wary of what you choose to set up for system manager -- choosing something like all organizations will probably be overkill, and just consume cycles for no good reason) .... be aware that this step can take some time, In practice, I've often found that it starts working while I'm troubleshooting why it's not working ...
  • Set up instances with a profile that includes the policies in AmazonSSMRoleForInstancesQuickSetup, or use that role, if you don't need anything custom in the role
  • Ensure that outgoing HTTPS access is allowed (usually, outgoing access is not restricted, but some security practices might lead to restricting outgoing access)
  • The SystemManager agent uses outgoing HTTPS to talk to SystemManager. If the instance image doesn't already included it, the agent will need to be installed.

cognitiaclaeves avatar Aug 04 '21 17:08 cognitiaclaeves