AWS Session Manager Step by Step Tutorial: SSH | Port-Forward | Audit | Logs

in this video i'm gonna show you how to use adobe assertion manager and ssh to the ec2 instances and also how you can port forward reports from the ec2 to localhost and in some cases you can replace the bastion host since you're not gonna need to open any inbound ports and also create key pairs and associate with them with the ec2 instances it's much easier to manage you're going to be able to see all the commands that that user will execute on that ec2 instance and let me quickly show you that let's go to the terminal and run aws ssm start session so we don't have any ports open or key pairs so be able to ssh that is to instance and maybe run some commands echo hello and also we're going to be able to see all the commands in the cloud watch so that's going to be the new log stream you can go to the log group and here for example you can see that this user executed hello and that's the output and also i want to show you that you're going to be able to use the port forward command so like that so you can port forward certain ports from the remote ec2 instance to the localhost let me run it and let's go and navigate to the localhost 8080 all right we can port forward engine links from that remote ec2 instance to localhost all right let's get started first of all we want to create the i'm roll and instance profile let's go to aws search for im and under the rows section we can create our role let's select ec2 instance click next permission and here we're going to attach one of the adwords managed policies which is called ssm full access let me search for it and this policy will allow us not only ssh but also stream logs from that instance to be able to see what kind of commands were executed on that instance all right let's click create escape this section and let's call it ssm full access all right when when we create the am roll it also will create the instance profile all right so the next step is to create the ec2 instance and attach this role let's go to ec2 instance and we can navigate here and click launch instance and uh one of one of the requirements is that your ec2 instance must have the ssm agent installed and most of the mis already comes with that agent but you might want to verify if you're not going to be using the ubuntu so i'm going to select ubuntu 2004 select then i'm going to select micro next and also another requirement is that the caveat i would say that that instance must be placed in the subnet with the internet access either with the public ip address and internet gateway so default route or in the private subnet but not gateway must be present there as well and let's we don't need the public ap address in our private subnet here and also don't forget to attach your ssm full access ins profile click next we don't need storage we don't need tags and let's create the new security group let's call it ssm and as i said before session manager does not require any ports open so let's close this so right now we don't have any inbound ports open at all let's review launch launch and also we don't need public keys so we not we don't need to associate with the key player and because session manager doesn't work like that launch alright so we can click on that instance and the first step you want to do you want to verify that this instance uh registered with the session manager so let's see 8 g3d right so let's go to the session manager and session manager is the part of the system manager which has much more capabilities such as run command etc so let's go and navigate to the session manager and here you can see and if you click on start session uh you should be able to see your rest instance here and it usually takes few minutes to register itself so let's wait and that's the first step that you need to verify otherwise you will not be able to use session manager let's just wait a little bit all right so all right so we have the our instance registered means that we're going to be able to use the session manager now let's uh go ahead and create the cloud watch log group it's optional but it's very useful to be able to see what's going on in that instance so let's go to the cloud watch and let's create the new law group called ssm session under blog groups you can create the log group and maybe for expiration let's give it 14 days and let's click create now we need to update our session manager to use this logo let's go back to the session manager session manager and then under preferences uh let's click on edit scroll down a little bit and you can see that cloudwatch login let's enable it and let's use stream for simplicity we're not going to encrypt power logs let me uncheck allow only encrypted cloud watch law groups and select the one that we just create and let's go ahead and click save all right it's saved now um i assume that you already have the adw cli installed but you still need to install the session manager plugin and you can do it by following the official guidelines uh from aws so i'm on mac so you can if you're on windows you're gonna follow this it's very simple instructions so let me just install for mac so that's the let's click me here to start let's go ahead and download the zip archive go back to terminal and run the following command and it's gonna download this zip archive all right now we need to unzip it let's say yes to all all right and let's install it and let me enter my password alright so installation successful now we need to create them i am role well we need to create the user right that gonna be able to ssh let's go back to adobe s let's go to im and first of all we are going gonna create the policy create policy select json let me paste it okay so we have few statements here the first statement will allow us to start session and ssh on this on all instances in our adwords account that's going to be our region and this is the account that you can grab it from here for example also we're going to restrict access to only certain ec2 instances with the tags service equal to proxy the second statement will be to allow us to uh use port forward and we're gonna allow on all instances for that user to use this port forward session command and the last one is to terminate all right let's click next next and let's give it a name user start session policy create policy all right we have our policy now let's go ahead and create the i'm group go to i'm groups create that group and let's attach our policy let's select the customer manage policies and that's going to be us all right let's create that go and also let's create the user let's go to the user add new user we're going to call it developer and give it only programmatic access and we're going to place it in ssm access group all right next review create user and let's download the credentials alright so the next step is to ssh to ec2 instance and to do that first of all we need to configure um cli so you can either use the environment variables or you can use the configure command so let me first of all i need those credentials and run adws configure this is going to be my key and that's going to be in the secret key and that's my default region and format json all right and now we can ssh and to do that we need we we're gonna run the following command lbs same start session target and then we need to provide the target is to instant id let's go back to ec2 instance instances and that's the our idea let me grab it and let's try it and it says that the start session operation by our user developer is not authorized well it's not authorized because this instance doesn't have the tags let's go ahead and go to the tags manage tags and add a service and that's the proxy tag which is comes from our policy service proxy let's save it let's go back and let's try again all right now we can ssh and we can install for example nginx in that instance all right let's do that let's run sudo up install nginx let's run clear and let's verify that it's up and running all right so we have the nginx now well we can go to the first of all i want to show you that we have the session go to system manager session manager and you can see that we have the active session and let me just exit and you're gonna be able to see all the commands in the cloudwatch go to cloudwatch go to log group and that's the one that we created and here you have the log stream let's open it up and you can see that for example the last one let's maybe this one so you can see that we run this command systemctl status nginx all right that's the one and the last thing that i want to show you in this video is to how you can port forward and it's very easy and you just need to run the following command that's going to be the command so and we're going to use the start session target we're going to replace this with our ec2 instance id then the document name we just start port forward session and that's going to be the first port within inside that is to instance and the second will be on our localhost so let's go ahead and replace that id let me grab it again from ec2 instances all right let's run this command and now we can start the session and put it forward all right let's uh try to access it locally go to localhost 8080 and we have access to our nginx alright thank you for watching please subscribe to my channel and like this video thanks bye you

Channel: Anton Putra

Views: 16,567

Keywords: aws session manager, aws session, aws session manager iam role, aws session manager vs bastion host, aws session manager install, aws session manager tutorial, session manager aws, session manager plugin, session manager iam role, aws session manager step by step, devops, aws, sre, anton putra, aws session manager ssh, aws session manager port forward, aws session manager logs, aws system, aws systems manager tutorial, aws systems manager demo, aws session manager audit

Id: _LEmH0mK4zU

Length: 14min 16sec (856 seconds)

Published: Mon Mar 29 2021