On: LazySSH – A jump-host SSH server that starts machi...

[lenova]

If you're on AWS, you can create a private SSH host without needing to open any ports to the internet, using AWS Systems Manager:

- Create an EC2 instance in a private subnet, and assign the AmazonSSMManagedInstanceCore IAM role to it

- Install the AWS CLI tools on your desktop

- Add a function to your .bash_profile like this:

  function jumphost() {
  JUMP_ID=$(aws ec2 describe-instances --filter "Name=tag:Name,Values=my-jumphost-name" --query "Reservations[].Instances[].InstanceId[]")
     echo "Starting jumphost..."
     aws ec2 start-instances --instance-ids $JUMP_ID
     sleep 30
     aws ssm start-session --target $JUMP_ID
  }

Then just run "jumphost" from your terminal and boom, SSH'ed in via the magic of SSM.

Bonus points: add a cronjob to your jumphost to shutdown every X hours in case you forget ;-)

[mdaniel → lenova]

I've gotten a lot of mileage out of Sigil (https://github.com/danmx/sigil#readme ) which supports starting sessions via Name tag, instance-id, or private-dns-name in order to save one the need to use awscli in a lot of cases; it also supports the handy `sigil ls` to show the connected instances, since trying to start an SSM connection with an instance whose agent is offline produces a dumb error message with start-session

---

as an aside: `function name()` is redundant; the `function name {` syntax is a bashism, `name() {` is the posix syntax

and you may find `aws ec2 wait instance-running` handy instead of the sleep: https://docs.aws.amazon.com/cli/latest/reference/ec2/wait/in...

[markfive → lenova]

Systems Manager also supports Port Forwarding: https://aws.amazon.com/blogs/aws/new-port-forwarding-using-a...

[kosinus → lenova]

Oh, that's interesting! Didn't know AWS had that ability. Maybe then there are also some SDK functions I don't know about? I wonder why Packer doesn't go this route.

Super tiny downside to your approach: you'll be paying for storage of that instance while shut down, I guess. But that's probably peanuts.

[gtsteve → kosinus]

I was about to comment that I looked into this a while back and they thought it would be too complicated to implement... but it seems that it was actually implemented [0] earlier this year. I haven't tried it out but that seems quite promising to me.

[0] https://github.com/hashicorp/packer/pull/9082