Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance:
gcloud compute ssh <instance_name>
GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address.
Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM service and a websocket connection is established from the machine you need to remote into. A cool solution.
I'm pretty sure this only works if you use images with Google's sauce added, which means your instances run Google daemons that do things like network, user, and ssh config.
Comments
Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance:
GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address.[1]: https://cloud.google.com/compute/docs/instances/managing-ins...
[2]: https://cloud.google.com/iap/docs/using-tcp-forwarding
Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM service and a websocket connection is established from the machine you need to remote into. A cool solution.
I assume it also logs the access in the SSM audit logs.
EC2 Connect is OSLogin-esque: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-inst...
I'm pretty sure this only works if you use images with Google's sauce added, which means your instances run Google daemons that do things like network, user, and ssh config.
Correct albeit no Google daemons, just OpenSSH server, PAM and NSS configurations:
https://cloud.google.com/compute/docs/oslogin/#how_os_login_...
That's good to know.
...But if you use an image with Google's sauce, there are Google daemons running on it, just not for this.
https://cloud.google.com/compute/docs/images/install-guest-e...