AWS Session Manager: less infrastructure, more features

栏目: IT技术 · 发布时间: 4年前

内容简介:Hey I'mAWS Systems ManagerYou can use Session Manager to access instances via the AWS Console, or if you install the

AWS Session Manager: less infrastructure, more features

Hey I'm Jon , CTO at Sym, and I've been building support for AWS Session Manager into our access management products. We're finding that many people still don't know about the features of Session Manager and how it can help them simplify their infrastructure, so I thought I'd share a bit of what we've learned.

Less infrastructure

AWS Systems Manager Session Manager enables SSH access that is managed solely with IAM permissions. This approach has major benefits for infrastructure owners:

  • No more bastion hosts required! Session Manager uses AWS APIs to communicate with your instances, so you can remove the administrative burden of maintaining bastion hosts.
  • Fewer SSH ingress rules! Since your team is getting SSH access through Session Manager, you can remove ingress from your firewall and reduce your attack surface.

Log in via the console or command line

You can use Session Manager to access instances via the AWS Console, or if you install the AWS CLI Plugin , then you can also start sessions from your local workstation.

Console access

AWS Session Manager: less infrastructure, more features

Command-line access

AWS Session Manager: less infrastructure, more features

More features

Beyond simplifying your infrastructure, Session Manager comes with a bunch of additional helpful features. I'll highlight two of those here.

Managing access with tags

You can take advantage of conditional IAM policies to partition access to your instances in interesting ways. This statement, for example, only grants session access to instances that are tagged as part of the Analytics department:

{
    "Effect": "Allow",
    "Action": "ssm:StartSession",
    "Resource": "arn:aws:ec2:*:*:instance/*",
    "Condition": {
        "StringLike": {
            "ssm:resourceTag/Deparment": "Analytics"
        }
    }
}

Logging your session activity

You can enable logging of what people are actually doing on instances when they SSH in. Logs can got to S3 or, if you've got CloudWatch logs set up on your instances, to CloudWatch logs.

In either case, each user's session gets logged with a Session ID that includes the user's name, such as foo@example.com-0391fd059b5290de2 . From the Session ID you can get other metadata about the session, such as the EC2 instance, Start Time, and End Time:

AWS Session Manager: less infrastructure, more features

You can dig in to the details of a session and see what commands someone ran like so:

AWS Session Manager: less infrastructure, more features

Required setup

The AWS Systems Manager Agent needs to be installed on your instances. The agent comes by default on Amazon Linux or can be installed on most other OSes.

You also need to ensure your instances have permission to talk to Session Manager. You can use the AWS-provided AmazonSSMManagedInstanceCore Managed Policy for this, or craft your own policy.

Kicking the tires

If you want a quick way to try Session Manager out, the terraform-okta-ssm-modules repo has examples to get you started.

Further reading

Disney Streaming released SSM Helpers , which includes a command-line wrapper for SSH access with lots of extra features.

Hope you learned something! I'd love to learn how you're using Session Manager or what other features/integrations you'd like to see us explore. There are additional Session Manager features like port forwarding that I plan to write about soon. Please send me a Twitter DM ( @firstmorecoffee ) or email ( jon@symops.io ) with your feedback.


以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持 码农网

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

计算机程序设计艺术(第3卷)-排序和查找(英文影印版)

计算机程序设计艺术(第3卷)-排序和查找(英文影印版)

(美)Donald E.Knuth / 清华大学出版社 / 2002-9 / 85.00元

《计算机程序设计艺术排序和查找(第3卷)(第2版)》内容简介:这是对第3卷的头一次修订,不仅是对经典计算机排序和查找技术的最全面介绍,而且还对第1卷中的数据结构处理技术作了进一步的扩充,通盘考虑了将大小型数据库和内外存储器。它遴选了一些经过反复检验的计算机方法,并对其效率做了定量分析。第3卷的突出特点是对“最优排序”一节作了修订,对排列论原理与通用散列法作了全新讨论。一起来看看 《计算机程序设计艺术(第3卷)-排序和查找(英文影印版)》 这本书的介绍吧!

RGB转16进制工具
RGB转16进制工具

RGB HEX 互转工具

图片转BASE64编码
图片转BASE64编码

在线图片转Base64编码工具

RGB CMYK 转换工具
RGB CMYK 转换工具

RGB CMYK 互转工具