EC2 Instance doesn't become managed after installing SSM Agent - amazon-web-services

I've installed SSM Agent (2.2.607.0) on Windows Server 2012 R2 Standard instance with the EC2 Config (4.9.2688.0). After installing it, i cannot see the server on the Managed Instances screen. I did the same steps on other servers (Windows and Linux) and it worked.
Tried to uninstall the EC2 Config, reinstalled it again with no luck. Tried to install a different SSM Agent version (2.2.546.0) with no luck also.
Any thoughts?

The agent is installed, but the instance still needs the proper role to communicate with the systems manager. Particularly this step of Configuring Access to Systems Manager.
By default, Systems Manager doesn't have permission to perform actions
on your instances. You must grant access by using an IAM instance
profile. An instance profile is a container that passes IAM role
information to an Amazon EC2 instance at launch.
You should review the whole configuration guide and make sure you have configured all required roles appropriately.

I had this problem, and of the four troubleshooting steps - SSM Agent, IAM instance role, Service Endpoint connectivity, Target operating system type, it turned out that the problem was endpoint connectivity.
My VPC, Subnet, route table, and internet gateway all looked correct (and were identical to another instance which was being managed by SSM). But the instance didn't have a public IP, and without that you can't use the IGW. You can't use a VPC endpoint and an Internet Gateway. So adding a public IP allowed the instance to connect to SSM and become managed.
Extra complication : I was trying to use EC2 Image Builder, which creates an instance without a public IP. So there is no way to use Image Builder in a VPC which has an Internet Gateway.

New SSM agent version comes with a diagnostic package.. You can run that to see which prerequisites is missing.
https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-cli.html

Related

Using Session Manager to connect RDS without having EC2 instance

When I go through the documents, using session manager we can connect instance in private subnet without having bastion host itself [direct port forwarding from local to private ec2].
But in RDS case, even though we are making connection using session manager we need a EC2 instance in between local and private RDS.
Could you anyone explain me why it is like that? please share some document that explains that as well.
AWS Systems Manager Session Manager allows you to connect to an instance in a Private Subnet because the instance is actually running an 'SSM Agent'. This piece of code creates an outbound connection to the AWS Systems Manager service.
Then, when you request a connection to the instance, your computer connects to the AWS Systems Manager service, which forwards the request to the agent on the instance. The AWS Systems Manager service is effectively acting as a Bastion for your connection.
AWS Systems Manager Session Manager cannot provide a connection to an Amazon RDS server because there is no ability to 'login' to an Amazon RDS server. Given that your RDS server is running in a Private Subnet, it is therefore necessary to port-forward via an EC2 instance in the same VPC as the RDS server. This can be done via a traditional Bastion EC2 instance in a Public Subnet, or via an EC2 instance in a Private Subnet by taking advantage of the Port Forwarding capabilities of AWS Systems Manager Session Manager.
I have got answered the same question in the AWS repost by #Uwe K. Please refer below.
SSM allows many more functions - and changes! - to an instance then just connecting to it. Having full SSM functionality on an RDS instance thus would undermine the Shared Responsibility Model we use for RDS (you could also say: it would violate the "Black Box" principle of RDS). Therefore, you need an intermediary instance that forwards the TCP Port exposed by RDS to your local machine.
Further reading:
The RDS-specific Shared Responsibility Model is explained here https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html
a general overview of the Shared responsibility model https://aws.amazon.com/compliance/shared-responsibility-model/
In order to connect to any EC2 instance with AWS systems manager, the SSM agent must be installed on that machine and the appropriate permissions need to be set up for the instance.
At the moment, AWS does not support this to RDS directly. In order for them to support such a setup, they'd probably need to install the agent on all RDS instances which generates quite some overhead and who knows what else the complexities of such a setup would have.
So at the present moment the most effective way to connect is setting up a tunnel via an EC2 instance.

Is there a bootstrap script to install Amazon SSM Agent into EC2 Windows instance upon launch?

I was tasked to spin up Windows 2019 servers (as per AWS documentation, this has SSM agent preinstalled) and disable port 3389 for RDP because the only access they want is via Amazon Systems Manager Session Manager.
I have attached the AmazonSSMManagedInstanceCore role which gives Session Manager permissions to access this server programmatically, but I still have issues accessing this server via Session Manager. Possible errors are:
The agent is not installed,
The required IAM role is not attached etc.
But I have done all this and am still unable to access this server.
So I want to be able to edit the UserData with a bootstrapping script that installs SSM agent and see if that fixes the issue.
My guess is maybe someone tampered with the server and deleted the SSM agent file.
This doesn't answer the question about a bootstrap script, as I am still researching on that
But I solved the issue I had with AWS Systems Manager Session Manager.
The SSM Agent was still installed in the servers.
Upon creating my VPC, I had created a private subnet and a VPC endpoint which Session Manager will use to talk to resources in that subnet, but I later on deleted the private subnet, since they (my company) wanted all servers in a public subnet.
Due to the VPC endpoints created, Session Manager wasn't able to locate the servers I was trying to connect to via Session Manager.
SOLUTION: After deleting the VPC endpoints, Session Manager now connects to all those servers with ease... Yay!!!
FYI: I still would love a bootstrap script that will install SSM Agent to Amazon EC2 Windows Servers upon launch.

AWS EC2 + Cloudfront - Can I SSH in via CloudFront without a keypair?

I have inherited a webserver on AWS running an EC2 instance
which is inherited via CloudFront.
I want to SSH in, but there is no keypair assigned to the EC2 instance.
The previous dev is not very helpful - all he told me was "use cloudfront".
Looking into CloudFront - I saw nothing that indicated I could SSH in that
way. Did I miss something?
Is it possible for me to access the instance via SSH without a private key
via Cloudfront?
I would appreciate any help
You can't ssh into your instance through CloudFront. If you don't have the private key to ssh, there are some options you can use:
Try EC2 Instance Connect which is a web-based ssh client. It will not ask for private key, if it works.
Try AWS Systems Manager Session Manager which is also web client. This will work even if the instance was launched without any ssh client. You will need to read up on how to set it up as it requires special instance role, and the ability of the instance to connect to the SSM service.
Use AWSSupport-ResetAccess SSM Automation to reset the ssh key for the instance.
Use recovery instance as shown in the official AWS video.
The best options would be to try 2 and 1. But depending on how the instance is setup, is it in private or public subnet, does it have internet access, is it Amazon Linux 2 or some non-standard AMI, what kind of roles it has, etc., you may need to perform extra steps to make it work.
Options 3 and 4 will require downtime and making backup before you attempt them would be good choice. Options 1 and 2 may work without any downtime, depending on the instance current setup.

Amazon Linux 2 instances won't appear in Systems Manager

I think I've done everything listed as a pre-req for this, but I just can't get the instances to appear in Systems Manager as managed instances.
I've picked an AMI which i believe should have the agent in by default.
ami-032598fcc7e9d1c7a
PS C:\Users\*> aws ec2 describe-images --image-ids ami-032598fcc7e9d1c7a
{
"Images": [
{
"ImageLocation": "amazon/amzn2-ami-hvm-2.0.20200520.1-x86_64-gp2",
"Description": "Amazon Linux 2 AMI 2.0.20200520.1 x86_64 HVM gp2",
I've also created my own Role, and included the following policy which i've used previously to get instances into Systems Manager.
Finally I've attached the role to the instances.
I've got Systems Manager set to a 30 min schedule and waited this out and the instances don't appear. I've clearly missed something here, would appreciate suggestions of what.
Does the agent use some sort of backplane to communicate, or should I have enabled some sort of communication with base in the security groups?
Could this be because the instances have private IPs only? Previous working examples had public IPs, but I dont want that for this cluster.
Besides the role for ec2 instances, SSM also needs to be able to assume role to securely run commands on the instances. You only did the first step. All the steps are described in AWS documentation for SSM.
However, I strongly recommend you use the Quick Setup feature in System Manager to setup everything for you in no time!
In AWS Console:
Go to Systems Manager
Click on Quick Setup
Leave all the defaults
In the Targets box at the bottom, select Choose instances manually and tick your ec2 instance(s)
Finish the setup
It will automatically create AmazonSSMRoleForInstancesQuickSetup Role and assign it to the selected ec2 instance(s) and also create proper AssumeRole for SSM
Go to EC2 Console, find that ec2 instance(s), right-click and reboot it by choosing Instance State > Reboot
Wait for a couple of minutes
Refresh the page and try to Connect via Session Manager tab
Notes:
It's totally fine and recommended to create your ec2 instances in private subnets if you don't need them to be accessed from internet. However, make sure the private subnet has internet access itself via NAT. It's a hidden requirement of SSM!
Some of the AmazonLinux2 images like amzn2-ami-hvm-2.0.20200617.0-x86_64-gp2 does not have proper SSM Agent pre-installed. So, recreate your instance using a different AMI and try again with the above steps if it didn't work.
Could this be because the instances have private IPs only? Previous working examples had public IPs, but I don't want that for this cluster.
If you place your instance in a private subnet (or in a public subnet but without a public IP), then the SSM agent can't connect to the SSM Service. Thus it can't register to it.
There are two solutions to this issue:
Setup VPC Interface endpoint in a private subnet for SSM System Manger. With this your intances will be able to connect to the SSM service without the internet.
Create a public subnet with NAT gateway/instance, and setup route tables to route internet traffic from the private subnets to the NAT gateway. This way your private instances will be able to access the SSM service over internet through the NAT device.

How to limit aws instance ip range generated by ec2-instance create cli script?

In my jenkins environment, i have configured the AWS cli, which generates the AWS instance on the run using "ec2-run-instances" command. On this i create docker and run it. However, occassionally i need to debug the generated instance manually. Now the issue is that i am working in a secured environment, where access to unknown instances is blocked by default as per corporate security policies. So i could not login to generated aws linux instance.
I want to know, what can be the best way to handle this situation? Is there an option, using which i can specify aws instance would pickup from particular ip range?
Thanks in advance
What you are looking here requires configuration of a VPC - and run all your EC2 instances in it. A VPC can consist of one or more subnets - and be configured to how an IP range.
During the launch of an EC2 instance (manually or through CLI) - you can specify a subnet. The new EC2 instance will only come up in that IP range.
Depending on what you need, you can pick the VPC scenario
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenarios.html
(complexity increases from 1-3)