Goodbye SSH, use AWS Session Manager instead

Replacing SSH with the AWS Session Manager simplifies authentication, authorization, networking, as well as audit logs for administrator sessions on EC2 instances. So is it already time to say goodbye to SSH? Yes, especially if you are aiming for immutable virtual machines and therefore only need remote access for debugging.

Transcript

1. Goodbye SSH, use AWS Session Manager instead
2. Hello! I am Andreas Wittig. AWS since 2013. Freelancer. Everything Cloud and DevOps. 2
3. • Covers fundamental parts of AWS: EC2, EBS, EFS, S3, RDS, DynamoDB, Lambda, VPC, IAM, Auto Scaling, ELB, … • Learn how to build scalable, highly available, or even fault tolerant systems • Focuses on Infrastructure as Code with CloudFormation manning.com, amazon.com, or amazon.de Book Amazon Web Services in Action 3
4. • Running your web application on AWS with Docker: ECS and Fargate. • Simple to use and fast to implement! • A production-ready infrastructure for everyone. • Including deployment pipeline and Infrastructure as Code. cloudonaut.io/rapid-docker-on-aws/ Book Rapid Docker on AWS 4
5. Blog cloudonaut.io 5
6. Incident Mgmt marbot.io 6 • Manage CloudWatch alarms via Slack. • Built for small and agile teams. • Integrates with Elastic Beanstalk, RDS, EC2, Lambad, SNS, … • Built-in escalation strategy to minimize distraction. marbot.io
7. • Centralized AuthN and AuthZ (IAM) • Built-in Audit Log • Simplify Networking Benefits 7
8. 8 SSH Bastion Host
10. 1. Install the AWS Systems Manager agent on each EC2 instance (already installed on Amazon Linux). 2. Create an IAM role for the EC2 instance which grants access to the AWS Systems Manager. 3. Use IAM policies to restrict which IAM user or role can start a session with an EC2 instance. 4. Configure audit logs. 5. Use IAM policies to make sure engineers are not able to modify the audit log settings. Configuration 10
11. 11 Demo AWS Session Manager
12. • No built-in way to transfer files. • Copy&Paste of multiple lines is slow. • CTRL+C and others are not working (known bug). • EC2 instance is responsible for writing the audit log. Limitations 12
13. 13 Blog Post https:/ /cloudonaut.io/goodbye-ssh-use-aws-session-manager-instead/
14. 14 Thanks! Any questions? You can find me at @andreaswittig & andreas@widdix.de
15. Credits Special thanks to all the people who made and released these awesome resources for free: • Presentation template by SlidesCarnival • Photographs by Unsplash 15