SSH FS with AWS System Manager to Access EC2 Private Instances

[a410212]

Hi all.

I first have to mention that I really like this plugin. Thanks so much for providing this useful tool!

Issue: I tried to use the tool with an AWS EC2 instance which only can be connected through a AWS System Manager (ssm) tunnel. The hostname refers to the instance name (eg. i-0abc1234567890) and not a real host name. This causes an issue when resolving the hostname.

Can anybody please give me a hint how to establish a connection with such a setup?

Thx in advance

[SchoofsKelvin]

You might want to check out #7. When you edit a config, you can configure it to go through a SSH hop: This should be similar to how this AWS documentation connects to SSH through an AWS Systems Manager:

# Connect to manager over SSH, and make local tunnel 8080 point to port 22 of the other instance
ssh -i /path/manager.pem user@manager -L 8080:ec2-198-51-100-1.compute-1.amazonaws.com:22
# Now connect through the tunnel to the other instance
ssh -i /path/instance.pem user@127.0.0.1 -p 8080

While I am working on port forwarding in the extension, it's quite experimental and on a separate branch. But in your case, if all you want to do is just SSH to another instance through your manager, configuring a SSH hop should be enough. The SSH hop feature basically means that in config1 you select config2 as a hop, meaning that whenever you connect to config1, it'll first create a SSH connection to config2, then proxy a tunnel through config2 towards config1. It's the equivalent of ssh -J config2 config1.

Regarding using the instance name, for an SSH hop the extension should basically send whatever hostname you configured (e.g. of config1) to the hop (config2), which should resolve it there. It should use the DNS resolver on the SSH hop, not the one on whichever device VS Code is running.

[a410212]

Hi.

Thanks for you fast and descriptive response!

I wasn't able to configure it via the SSH hop option you describe. Instead I have to first start a port forwarding via AWS SSM command line like this:

> aws ssm start-session --target "i-abc0123456789" --document-name AWS-StartPortForwardingSession --parameters portNumber="22",localPortNumber="2222"

With this port forwarding setup I was able to connect to localhost:2222 in the SSH FS configuration!

So, I think what's missing is a kind of "proxy command" to start when the SSH session is initiated. Or do I have overseen something?

Thanks in advance

[SchoofsKelvin]

Ah, I thought you could directly connect to the manager using SSH.

Command-based proxying (i.e. ProxyCommand) is currently something (f387681) on the feature/ssh-config branch, see #107. It's a big feature set I still need to finish, so it'll take a while. I'll see about porting some early sub-features over to the master branch.

[matwey-s]

could somebody provide a config example using ssm?