Connecting to EC2 Instances

Setup and connection steps

SSH requires a key pair to create a connection with the EC2 instance. A key pair consists of a public and a private key, a set of credentials to prove identity when connecting to an EC2 instance. We can divide the SSH connection into three major parts as follows.

• Key pair creation: When launching an EC2 instance, we can specify a key pair during the instance creation process. This key pair consists of a public key added to the EC2 instance and a private key securely downloaded to the local machine.

• Permission setting for private key: Ensure that the downloaded private key file has the correct permissions to be executed. For example, use chmod 400 to restrict access to the owner only.

• Connect using SSH:

  • Open a terminal on your local machine.

  • Use the ssh command to connect to the EC2 instance using the private key:

Replace /path/to/private-key.pem with the path to your private key file, ec2-user with the appropriate user for the Linux distribution, and instance-ip-address with the public IP or DNS of your EC2 instance.

Remote desktop for Windows instances

Remote Desktop Protocol (RDP), a network protocol offered by Microsoft, provides a graphical interface to connect to a Windows-based computer over a secure network connection. RDP allows users to interact with a remote desktop as if they were sitting in front of it, accessing its desktop environment, applications, and resources. It facilitates secure communication between remotely connected machines over an encrypted channel.

RDP is normally used in a client-server architecture; it operates on TCP and uses port 3389 by default. RDP offers secure remote access to Windows-based EC2 Instances.

Setup and connection steps

• Download and install remote desktop client: Download and install a Remote Desktop Client on your local machine, for example, Microsoft Remote Desktop for Windows and macOS.

• Administrator password retrieval: When launching a Windows EC2 instance, retrieve the administrator password by decrypting the Windows Administrator password from the EC2 Console using the key pair specified during instance creation. Upload the private key file or paste the contents of the private key and decrypt the password.

• Connect using a remote desktop: Open the Remote Desktop Client. Enter the public IP or DNS of your Windows EC2 instance and provide the administrator username and password retrieved earlier.

AWS Systems Manager Session Manager (Instance Connect)

AWS Session Manager allows to securely connect to the EC2 instances without managing SSH keys or opening inbound ports. It creates a temporary, secure session directly from the AWS console or CLI. It simplifies administration and improves security by eliminating the need for complex bastion hosts.

Setup and connection steps

• IAM Role configuration: Ensure that your EC2 instance has an AWS Identity and Access Management (IAM) role with the necessary permissions for Systems Manager.

• Session Manager installation: AWS Systems Manager Agent (SSM Agent) must be installed and running on the EC2 instance. Most Amazon Machine Images (AMIs) come with SSM Agent pre-installed.

• Systems Manager Console connection: In the AWS Management Console, navigate to Systems Manager, go to “Session Manager,” and select “Start Session” for the desired EC2 instance.

• Browser-based SSH or Remote Desktop access: Use the browser-based AWS Management Console to securely access your EC2 instance without the need for external SSH keys or Remote Desktop client software.

Best practices for secured connection

• Security groups: Ensure that the security group associated with your EC2 instances only allows incoming traffic on the relevant ports, 22 for SSH and TCP 3389 for Remote Desktop.

• Key pair management: Keep your private key files secure and rotate them periodically for enhanced security.

Understanding these connection methods is important for managing EC2 instances securely and efficiently. It is important to identify the specific requirements of each use case and choose the most suitable method based on the operating system and preferred workflow. Always follow AWS best practices for security and access management.