Nodes as SSM Managed Instances

[nickd-beemit]

Describe the feature

Give worker nodes SSM IAM perms so they become SSM-connected

Use Case

All of the Good Things about SSM

• Access instances without publicly exposing them
• Monitoring, operations

Proposed Solution

Add AmazonSSMManagedInstanceCore to worker node Instance Profiles

Other Information

I tested manually doing this and it worked; the SSM Agent is already installed and will connect on launch.

I may be able to implement but am CDK noobie and NFI where the change is required.

Acknowledgements

• [X] I may be able to implement this feature request

CDK version used

2.25.0

EKS Blueprints Version

1.0.4

Node.js Version

v18.2.0

Environment details (OS name and version, etc.)

Darwin FVFG72MLQ6LT 21.5.0 Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:29 PDT 2022; root:xnu-8020.121.3~4/RELEASE_ARM64_T8101 arm64

[shapirov103]

@nickd-beemit have you tried leveraging the SSMAgent add-on? It does add permissions to the node role.

[nickd-beemit]

Thanks!