AWS Session Manager: less infrastructure, more features

Are they basically trying to emulate GCP’s OS Login (<a href="https:&#x2F;&#x2F;cloud.google.com&#x2F;compute&#x2F;docs&#x2F;instances&#x2F;managing-instance-access" rel="nofollow">https:&#x2F;&#x2F;cloud.google.com&#x2F;compute&#x2F;docs&#x2F;instances&#x2F;managing-ins...</a>) feature here? We’ve been using that for a while, and it’s been a big relief.

I&#x27;d love to learn how you&#x27;re using Session Manager or what other features&#x2F;integrations you&#x27;d like to see us explore. Also if the terraform module packaging is useful. There are additional Session Manager features like port forwarding that I plan to write about soon.

I never see mention of Windows with Session Manager. I have a mixed infrastructure with a number of Windows (IIS) app servers running various things.<p>We currently connect via SSH to a bastionhost, then tunnel from there to various systems, which allows connecting to SSH (linux instances), RDP (Windows), or basically any other network services like Redis or a database. I ended up writing some scripts to automate all this, so as long as you have the right certificates and IAM permissions, you can connect with a single command -- for Windows instances, it even retrieves the randomized password from the EC2 API. The end result is for any EC2 instances you&#x27;re instantly popped into a shell&#x2F;RDP session without having to enter credentials.<p>I&#x27;d love to replace this with something better (eg Session Manager), but I&#x27;ve not seen how to do this for RDP, and haven&#x27;t had the time to go experimenting on my own to see if it&#x27;s even possible. If I can&#x27;t 100% replace the bastionhosts, having two entirely different connection methods doesn&#x27;t solve anything (and in fact makes it worse, because it&#x27;s harder to use).

Be careful with SSM in general. The documentation suggests adding the AmazonEC2RoleforSSM policy to the role of the EC2 instances you want to access via Session Manager. This role grants read&#x2F;write to all S3 buckets in your account (amongst other things). See this article for better steps and unavoidable risky things: <a href="https:&#x2F;&#x2F;cloudonaut.io&#x2F;aws-ssm-is-a-trojan-horse-fix-it-now&#x2F;" rel="nofollow">https:&#x2F;&#x2F;cloudonaut.io&#x2F;aws-ssm-is-a-trojan-horse-fix-it-now&#x2F;</a>

I wrote a follow up post to this on SSH tunneling: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22665037" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22665037</a>

Does anyone know how this works with other utils that use SSH protocol, like rsync? What about tunneling other services to or from a local host? I&#x27;d love to have fewer hosts to maintain and a smaller network&#x2F;attack surface, but we use SSH for more than just gaining commandline access to our instances.

The author states:<p>&gt;&quot;No more bastion hosts required! Session Manager uses AWS APIs to communicate with your instances, so you can remove the administrative burden of maintaining bastion hosts.&quot;<p>Does this presume the EC2 instances have a public IP or is there a way this would also work with EC2 instances on private subnets?

It&#x27;s great for managing active SSH sessions, but not so much for the other purpose for bastions: fine-grained network access control+routing. It would be cool if they made a more specific version of this just for network traffic without the SSH component.

Hey, what about the Werbot solution - werbot.com? Now it is very relevant.

IAM is easy to mess up.<p>Would be interesting to lock down the session manager agent (if possible) so that the only way to privileged access is through sudo-like priv esc that uses 2fa.

Does anyone know of it works with Ansible ? Thanks!

This is awesome! How can I install the the agent if I&#x27;m not using Amazon Linux?