#Bastion ec2 how to#
#Bastion ec2 series#
#Bastion ec2 windows#

#Bastion ec2 how to#

Not only will this article show you how to create a SSH terminal connection to an EC2 machine, but it will also show you how you can setup pgAdmin to connect and administer a RDS hosted PostgreSQL database without having to expose the RDS instance on a public subnet! Pre-requisites:

#Bastion ec2 windows#

In this post, I will quickly walk through the steps necessary to create the SSH tunnels necessary to access an EC2 machine and a RDS database sitting on internal subnets in AWS from a Windows terminal using the PuTTY tool (henceforth referred to simply as “Putty”). In the next post we’ll discuss SSH connection multiplexing, port forwarding, and using SSH as a SOCKS proxy.Accessing AWS resources, such as a Linux EC2 machine or a PostgreSQL database hosted on RDS, from your local development machine can be a little bit tricky, since these resources are generally recommended not to be exposed to the Internet and involves a technique called SSH tunneling. Now you should be able to connect to any machine matching one of the host patterns and it will automatically and transparently look up and use the bastion host. You will likely want to adjust *. and SSHBastion to match your environment. Prox圜ommand ssh -A ec2 describe-instances -filters 'Name=instance-state-name,Values=running' 'Name=tag:Name,Values= SSHBastion' 'Name=tag:Subnet,Values=public' | jq -r. Now all we need to do is incorporate that command in place of the bastion host address in the ssh configuration: Host *. If that fails, make sure that all the requirements mentioned above have been met. That command should return a public address of the bastion host, such as: You will likely wish to replace the bolded “SSHBastion” with whatever tag value you wish to use. 'Name=instance-state-name,Values=running' Now, to test that we can get the relevant bastion host’s address, let’s run a simple command and verify that we get the correct result (lines broken for readability, but this is one long command): aws ec2 describe-instances -filters Basically, anything that can consume JSON, search for specific subkeys, and return the relevant values will work.

It’s possible to use one of a number of other utilities for that same purpose.

The command line utility jq must be installed.

You could also have various bastion servers in the same AWS environment, but you will need to be able to map the destination machines (via DNS or IP range in a way that can be put in the Host line of the SSH configuration) to the relevant EC2 tag.

In this example, we have a machine with the tag Name with a value of SSHBastion.

You must be able to SSH into this machine, since it will be the bastion server. That EC2 instance must be on a public subnet that you have access to.

There need to be a single EC2 instance in each target AWS environment with a unique tag, so that we can search for that tag and get the address of that single EC2.

You can test if it’s working by running: aws ec2 describe-instances.

It’s possible to change the AWS access credentials in the shell environment to switch to a different AWS environment.

The aws command-line utility must be installed and the shell environment must be configured to allow access to the destination AWS environment.

This could easily be extended or modified to use any other means of dynamically loading the hostname during the connection. Here we will describe how to load the bastion server’s address from AWS, using AWS tags and the shell environment’s AWS authentication information.

Part 1: Using SSH Through A Bastion Host Transparentlyĭynamically loading the bastion server address from AWSĬredit to my colleague Jason Mao for devising this technique.

#Bastion ec2 series#

This is the second part of a series about using SSH with bastion hosts. You may wish to read the first part for background about using SSH bastion hosts: