Solving the SSH over SSM is sadly useless right now.
The whole point of why we began using SSM was logging.
1) We soon discovered that using bash (and not sh that SSM signs you into) doesn’t format the logs correctly and makes them unreadable
2) Using SSH over SSM doesn’t log at all
Both of these problems are on AWS github but as always, they don’t respond.
Does SSM generate unique users for each login or does it use a generic user? The later would make any logging outside of SSM difficult since there's no way to tie it to a specific IAM user except time windows.
You can specify the behavior. There is no unique user for each login, by default you are dropped to generic ssm-user. It's possible to set up a log-in into specific user based on the IAM username.
The later would make any logging outside of SSM difficult
There is a way to tie IAM user to SSM. You have to request SSM permissions and AWS logs that. AWS logs pretty much every single API call so it's just matter of storing and auditing correctly.
There is a way to tie IAM user to SSM. You have to request SSM permissions and AWS logs that. AWS logs pretty much every single API call so it's just matter of storing and auditing correctly.
If you're using a generic ssm-user (and going to ssh so there's no ssm logs of the commands) then wouldn't you not be able to distinguish the commands (say in auditd) of two people logging in at the same time?
I'm reminded of RDS which does not store enough logs anywhere to reconstruct which IAM user/role was running specific commands when using IAM Authentication unless you create individual users in the DB.
If you're using a generic ssm-user (and going to ssh so there's no ssm logs of the commands) then wouldn't you not be able to distinguish the commands (say in auditd) of two people logging in at the same time?
But that requires auditing directly on EC2, right? (You can indeed sync the logs somewhere, but that diminished the beauty of out of box logging)
I'm reminded of RDS which does not store enough logs
AFAIK, it's not possible with their current implementation to accomplish this. We just swallowed that it won't work and for the sake of security created seperate users.
Comments
Solving the SSH over SSM is sadly useless right now. The whole point of why we began using SSM was logging.
1) We soon discovered that using bash (and not sh that SSM signs you into) doesn’t format the logs correctly and makes them unreadable 2) Using SSH over SSM doesn’t log at all
Both of these problems are on AWS github but as always, they don’t respond.
Does SSM generate unique users for each login or does it use a generic user? The later would make any logging outside of SSM difficult since there's no way to tie it to a specific IAM user except time windows.
You can specify the behavior. There is no unique user for each login, by default you are dropped to generic ssm-user. It's possible to set up a log-in into specific user based on the IAM username.
If you're using a generic ssm-user (and going to ssh so there's no ssm logs of the commands) then wouldn't you not be able to distinguish the commands (say in auditd) of two people logging in at the same time?
I'm reminded of RDS which does not store enough logs anywhere to reconstruct which IAM user/role was running specific commands when using IAM Authentication unless you create individual users in the DB.
But that requires auditing directly on EC2, right? (You can indeed sync the logs somewhere, but that diminished the beauty of out of box logging)
AFAIK, it's not possible with their current implementation to accomplish this. We just swallowed that it won't work and for the sake of security created seperate users.