[{"data":1,"prerenderedAt":318},["ShallowReactive",2],{"project-22287174":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":36,"aspects":37,"strip":46,"post_text":48,"what":49,"said":58,"maker_in_thread":181,"shape":183,"grid":186,"attempts":280,"same_week":281,"maker_shows":39,"maker_hidden":310,"reader_version":311,"card":312},"22287174","ssh-over-ssm","Managing SSH Access to AWS EC2 Instances Using SSM","title","Show HN: Managing SSH Access to AWS EC2 Instances Using SSM","https:\u002F\u002Fgithub.com\u002Felpy1\u002Fssh-over-ssm","github.com","elpy1",1581320863,2020,131,36,472,3028,16,"notable","infrastructure","remote access","cli",[24,25,26,27,28],"ssh","aws ec2","aws ssm","session manager","bastion","mixed",0.333,{"positive":32,"neutral":33,"mixed":34,"critical":35},10,14,2,3,29,{"idea":38,"design":40,"privacy":42,"execution":43,"docs":45},{"positive":34,"critical":39},1,{"positive":34,"critical":41},0,{"positive":41,"critical":34},{"positive":44,"critical":41},4,{"positive":41,"critical":41},[39,35,47,35,41,41,41,35,35,41,35,35,35,41,35,35,35,47,47,35,39,35,35,39,35,47,47,35,41,41,47,47,47,47,35,47],5,null,{"problem":48,"audience":48,"pricing":48,"motivation":48,"time_to_build":48,"stack":50,"openness":57,"stage":57,"team_size":57},[51],{"value":52,"source":53,"evidence":54},"AWS SSM","inferred",[55],{"id":56},"post","unknown",{"praise":59,"objections":95,"requests":119,"questions":128,"alternatives":147},[60,76,87],{"value":61,"source":62,"evidence":63},"Removes need for bastion hosts and inbound SSH","commenter",[64,68,72],{"id":65,"by":66,"text":67},"22290733","jbergknoff","We've been using SSH over SSM at work, and it's been great for tying access to IAM credentials. Using the SSM tool as a ProxyCommand for OpenSSH is brilliant. I can SSH to an…",{"id":69,"by":70,"text":71},"22288515","williamdclt","Very funny, we received a ticket from a security audit a week ago asking us to get rid of our bastion and use SSM instead. Having never heard of SSM, being in a rush to a…",{"id":73,"by":74,"text":75},"22288104","nostrebored","Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM…",{"value":77,"source":62,"evidence":78},"Ties access to IAM permissions without managing access keys",[79,83],{"id":80,"by":81,"text":82},"22287379","sakisv","It's hard to overstate how much of a difference this makes for managing people's access to servers without having to manage access keys. Especially if someone leaves the…",{"id":84,"by":85,"text":86},"22288799","marcinzm","SSM doesn't require you to manage keys or have a bastion\u002Fvpn\u002Fpublic access. It'll also log access attempts, in some cases log commands, and ties into IAM permissions (ie: these…",{"value":88,"source":62,"evidence":89},"Easy to set up and use",[90,91],{"id":69,"by":70,"text":71},{"id":92,"by":93,"text":94},"22289071","BrandonBradley","I've been rolling SSM out at work; 10\u002F10 would do again.",[96,106,115],{"value":97,"source":62,"evidence":98},"Session logging is weak; SSH over SSM does not log commands",[99,103],{"id":100,"by":101,"text":102},"22287350","klohto","Solving the SSH over SSM is sadly useless right now. The whole point of why we began using SSM was logging. 1) We soon discovered that using bash (and not sh that SSM signs you…",{"id":104,"by":85,"text":105},"22289150",">There is a way to tie IAM user to SSM. You have to request SSM permissions and AWS logs that. AWS logs pretty much every single API call so it's just matter of storing and…",{"value":107,"source":62,"evidence":108},"Generic ssm-user makes per-person auditing hard",[109,112],{"id":110,"by":101,"text":111},"22289051","You can specify the behavior. There is no unique user for each login, by default you are dropped to generic ssm-user. It's possible to set up a log-in into specific user based on…",{"id":113,"by":101,"text":114},"22289234","> If you're using a generic ssm-user (and going to ssh so there's no ssm logs of the commands) then wouldn't you not be able to distinguish the commands (say in auditd) of two…",{"value":116,"source":62,"evidence":117},"Cannot do port forwarding to RDS through a bastion replacement",[118],{"id":65,"by":66,"text":67},[120,124],{"value":121,"source":62,"evidence":122},"Support for aliasing instance IDs to hostnames",[123],{"id":65,"by":66,"text":67},{"value":125,"source":62,"evidence":126},"Built-in user and key management",[127],{"id":65,"by":66,"text":67},[129,136],{"value":130,"source":62,"evidence":131},"How does this compare to AWS Secrets Manager",[132],{"id":133,"by":134,"text":135},"22289493","billman","Can anyone give any experience using this method vs. AWS Secrets Manager?",{"value":137,"source":62,"evidence":138},"How is this different from EC2 Instance Connect",[139,143],{"id":140,"by":141,"text":142},"22287449","vegardx","You can also use ec2-instance-connect[0] to enable users to generate ephemeral keys that are valid for a few minutes, authenticated with IAM. The benefit is that it's all native…",{"id":144,"by":145,"text":146},"22287463","leg100","Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: ``` gcloud compute ssh \u003Cinstance_name> ``` GCP takes care of generating a key pair. The…",[148,152,160,170,177],{"value":149,"source":62,"evidence":150},"GCP OS Login",[151],{"id":144,"by":145,"text":146},{"value":153,"source":62,"evidence":154},"EC2 Instance Connect",[155,156],{"id":140,"by":141,"text":142},{"id":157,"by":158,"text":159},"22287524","ignoramous","EC2 Connect is OSLogin-esque: https:\u002F\u002Fdocs.aws.amazon.com\u002FAWSEC2\u002Flatest\u002FUserGuide\u002Fec2-instance-connect-methods.html",{"value":161,"source":62,"evidence":162},"SSH certificates with step-ca or Vault",[163,167],{"id":164,"by":165,"text":166},"22287719","tilolebo","Hasn't this been solved by using SSH certificates instead of keys?",{"id":168,"by":141,"text":169},"22289179","It has to use an existing system account, yes. You do lose a lot of auditing abilities this way, since you cannot capture the content. For me this is more about establishing a…",{"value":171,"source":62,"evidence":172},"Okta Advanced Server Access",[173],{"id":174,"by":175,"text":176},"22290139","pquerna","(disclaimer, I was a founder of ScaleFT - acquired by Okta) This is exactly why many customers use Okta's Advanced Server Access:…",{"value":178,"source":62,"evidence":179},"Teleport",[180],{"id":168,"by":141,"text":169},{"comments":41,"answered":41,"key":182},[],{"commenters":184,"max_depth":47,"maker_replies":41,"first_comment_mins":185,"lifespan_hours":18},25,27,[187,189,191,193,197,201,203,205,206,210,213,215,216,218,220,224,226,230,231,233,236,238,240,241,242,243,247,251,255,258,262,264,267,270,274,276],[144,41,39,188,145,41],"project\u002Fcritical\u002Fidea",[157,41,35,190,158,41],"project\u002Fneutral\u002Fnone",[73,41,47,192,74,41],"project\u002Fpositive\u002Fdesign",[194,41,35,195,196,41],"22288301","project\u002Fneutral\u002Fprivacy","dkersten",[198,41,41,199,200,41],"22288584","commenter\u002Fneutral\u002Fnone","ses1984",[202,41,41,199,145,41],"22288702",[204,41,41,199,200,41],"22288871",[140,39,35,190,141,41],[207,39,35,208,209,41],"22287806","project\u002Fneutral\u002Fdesign","theomega",[211,39,41,212,141,41],"22287820","commenter\u002Fneutral\u002Fdesign",[214,39,35,195,85,41],"22288877",[168,39,35,195,141,41],[217,39,35,195,85,41],"22289286",[174,39,41,219,175,41],"other\u002Fneutral\u002Fnone",[221,39,35,222,223,41],"22290069","project\u002Fmixed\u002Fdesign","nodefortytwo",[65,34,35,225,66,41],"project\u002Fmixed\u002Fexecution",[227,34,35,228,229,41],"22292083","project\u002Fneutral\u002Fdocs","ReidZB",[80,35,47,192,81,41],[69,44,47,232,70,41],"project\u002Fpositive\u002Fexecution",[234,44,35,235,141,41],"22289483","project\u002Fneutral\u002Fexecution",[100,47,39,237,101,41],"project\u002Fcritical\u002Fprivacy",[239,47,35,195,85,41],"22288839",[110,47,35,195,101,41],[104,47,39,237,85,41],[113,47,35,195,101,41],[244,245,47,232,246,41],"22290304",6,"jon918",[248,249,47,232,250,41],"22287386",7,"vermon",[252,253,35,190,254,41],"22288596",8,"crucialfelix",[164,256,41,257,165,41],9,"commenter\u002Fcritical\u002Fidea",[259,256,41,260,261,41],"22288063","commenter\u002Fneutral\u002Fidea","bkmeneguello",[84,256,47,263,85,41],"project\u002Fpositive\u002Fidea",[265,32,47,263,266,41],"22287268","booi",[92,268,47,269,93,41],11,"project\u002Fpositive\u002Fnone",[271,272,47,232,273,41],"22294572",12,"m1keil",[133,275,35,190,134,41],13,[277,33,47,278,279,41],"22287290","maker\u002Fpositive\u002Fnone","wheelerwj",[],[282,287,291,296,301,306],{"id":283,"name":284,"points":285,"category":286},"22306996","Autocode",247,"dev_tools",{"id":288,"name":289,"points":290,"category":286},"22288276","geoman.io",214,{"id":292,"name":293,"points":294,"category":295},"22279308","HDMI",195,"hardware",{"id":297,"name":298,"points":299,"category":300},"22263758","LibreLingo",159,"learning_science",{"id":302,"name":303,"points":304,"category":305},"22268436","MIDAS",118,"ai",{"id":307,"name":308,"points":309,"category":300},"22290812","Mathpendium",108,false,"v2",{"id":313,"name":5,"line":6,"ai":310,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":314,"top":18,"kw":315,"maker":11,"domain":10,"tier":19,"attempts":41,"strip":316,"url":9,"mix":317,"praise":61,"objection":97,"sub":21},22287174,0.33,[24,25,26,27,28],"135300033033303335531331355300555535",[32,33,34,35],1794036586347]