search

buildkite / elastic-ci-stack-for-aws

An auto-scaling cluster of build agents running in your own AWS VPC
https://buildkite.com/docs/quickstart/elastic-ci-stack-aws
MIT License
418 stars 272 forks source link

Proposal: Remove default external SSH access; default to SSM #620

Closed tduffield closed 3 years ago

tduffield commented 5 years ago

This is an issue to track the discussion that started in https://github.com/buildkite/elastic-ci-stack-for-aws/pull/598.

Right now, SSH is open by default on Linux instances, but no such RDP access is made available for Windows. Ideally, we'd want access behavior to be consistent between the two platforms.

There were two solutions thrown out in the PR linked above:

  1. Open up RDP access by default on Windows
  2. Remove SSH access from Linux and add SSM access to both platforms

It seems that consensus was moving towards option 2 at the time of issue creation.

lox commented 5 years ago

Yup, I'm totally all for option 2.

xiaket commented 5 years ago

@lox We have a strong need for option 2. Do you mind if I open a PR for it?

lox commented 5 years ago

We would love that @xiaket!

xiaket commented 5 years ago

Hey @lox ! I just gave it a go and would like some input on a few details from you and the community before I finalize a PR:

  1. Do we want to enable SSM session access by default or do we want to provide a flag as a parameter and allow user to enable it?
  2. Do we want to have two PRs for this issue, one for enable SSM session access and the other for remove SSH access? Or one PR to have both?
  3. Since we are going towards a setup where no keypair is assigned to the ASG, I think we should also explicitly disable SSH service, what is your opinion on this?

Thanks!

jamesholmes-linktree commented 4 years ago

Hey @lox ! I just gave it a go and would like some input on a few details from you and the community before I finalize a PR:

  1. Do we want to enable SSM session access by default or do we want to provide a flag as a parameter and allow user to enable it?

SSM by default, with an appropriate IAM policy.

  1. Since we are going towards a setup where no keypair is assigned to the ASG, I think we should also explicitly disable SSH service, what is your opinion on this?

I would, yes. SSM should provide enough access without having to do SSH or port forwarding sessions.

lox commented 4 years ago

@pda @yob and @chloeruka will be able to assist!

yob commented 4 years ago

@jamesholmes-linktree's feedback looks reasonable to me. If someone was to pick this up, I think we'd be happy to have enabling SSM and disabling SSH within the same PR.