Giters

arminc / terraform-ecs

AWS ECS terraform module

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

AWS remote commands

arminc opened this issue · comments

commented

Don't use SSH but use AWS remote commands to execute commands on the instances. This is more secure and beter audited. http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ec2-run-command.html

commented

Hi! Could you, please, help me in the following question.
I need to debug why my application does not start on EC2 instance in ECS (I use this repository for deploy infrastructure). What should I do better? For AWS remote commands I also should use SSH. I need to assign elastic ip, allow ssh in security groups, etc?
Thanks

commented

@denishonig You can create a bastion host and give it access to the EC2 nodes on port 22 that way you can tunnel the SSH connection from your bastion host to your EC2 node.

Your PC -> bastion -> EC2 node for ECS

commented

Another way to access EC2 is to use AWS SessionManager https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html.

This is the method that I prefer. It requires setting up AWS Systems Manager, which I've found a bit futsy, but which seems to be getting better:

  • Quick start here: https://console.aws.amazon.com/systems-manager/home?region=us-east-1# (be wary of what you choose to set up for system manager -- choosing something like all organizations will probably be overkill, and just consume cycles for no good reason) .... be aware that this step can take some time, In practice, I've often found that it starts working while I'm troubleshooting why it's not working ...
  • Set up instances with a profile that includes the policies in AmazonSSMRoleForInstancesQuickSetup, or use that role, if you don't need anything custom in the role
  • Ensure that outgoing HTTPS access is allowed (usually, outgoing access is not restricted, but some security practices might lead to restricting outgoing access)
  • The SystemManager agent uses outgoing HTTPS to talk to SystemManager. If the instance image doesn't already included it, the agent will need to be installed.