patheard / aws-ecs-port-forward

Access private ECS task through SSM Session Manager port forwarding

AWS ECS task connect with SSM port forwarding

Connect to a private ECS test using SSM Session Manager port forwarding.

Requirements

• AWS CLI
• Session Manager plugin

Connect

aws ssm start-session \
    --target ecs:<CLUSTER>_<TASK ID>_<CONTAINER_RUNTIME_ID> \
    --document-name AWS-StartPortForwardingSession \
    --parameters '{"portNumber":["80"], "localPortNumber":["1338"]}' \
    --region ca-central-1

# Example
aws ssm start-session \
    --target ecs:internal_ad87713568a9469b8bb056780a2e1ffd_ad87713568a9469b8bb056780a2e1ffd-3386804179 \
    --document-name AWS-StartPortForwardingSession \
    --parameters '{"portNumber":["80"], "localPortNumber":["1338"]}' \
    --region ca-central-1

Credit

Most of this is taken from @mohamed-cds's example, with the addition of:

• using only VPC PrivateLinks to run the ECS task; and
• removing the ingress on port 80.