2023-02-28 · 5분
This post is over 2 years old. The content may be outdated.
Summary: if something is better than what you have, switch to it!
This assumes you've created a user, issued an Access Key, and connected it to the AWS CLI.
Let's pre-create the Role in IAM that will attach to EC2.
Configure it as above and press Next. Here you must choose EC2 Role for AWS Systems Manager.
If you followed along, you'll see the AmazonSSMManagedInstanceCore permission was added without any extra configuration. This permission is all you need. Press Next, enter just the Role name, and press Create Role.
Now let's move to EC2 and create a private instance.
For the EC2 settings I made a separate key pair as above, created a VPC, placed it in the private-a zone, and in security groups opened only the basic ports related to web, DB, and SSH — 22, 3306, 80, 443.
Then click the EC2 you made, go into its settings, and press Modify IAM role.
You can see the IAM role we made earlier is there. Select it and press Update IAM Role.
Then, trying an SSH connection as a test naturally fails — there's no public IP. And since there's no bastion EC2 either, connecting is impossible.
But if you've followed along this far, entering "aws ssm start-session --target <instances ID>" connects just fine.
Announcing the ability to enable AWS Systems Manager by default across all EC2 instances in an account AWS Systems Manager customers can now use the Default Host Management Configuration (DHMC) agent to enable Systems Manager in a single action and configure permissions for all EC2 instances in the account. — aws.amazon.com
In this update (2023-02-17), a new setting called Default Host Management Configuration (DHMC) was added to AWS Systems Manager.
DHMC is configured by specifying a permission (IAM role) in SSM's Fleet Manager. The SSM Agent then obtains credentials from the role set in DHMC instead of an instance profile, enabling SSM's various features.
Simply put, it's "the default rule that acts as a fallback when the EC2 has no profile".
※ Caution) The SSM Agent must be Ver. 3.2.582.0 or later. Earlier SSM Agents don't support DHMC.
First, create the IAM role to configure in DHMC.
Create it with AWS's AmazonSSMManagedEC2InstanceDefaultPolicy policy. This policy is roughly identical to AmazonSSMManagedInstanceCore, except the two ssm:getParameter(s) permissions are not allowed.
If you also want the EC2 instance to load from SSM Parameter Store, it's better to build the policy based on AmazonSSMManagedInstanceCore.
I'll name it SSMManagedEC2InstanceDefaultRole. Keep pressing Next to create it, then click the created role to open it.
Click SSMManagedEC2InstanceDefaultRole -> Trust relationships -> Edit trust policy.
Change ec2.amazonaws.com -> ssm.amazonaws.com and press Update policy. Now let's go configure DHMC.
Change the IAM Role as in the picture above and press Configure — DHMC setup is done. Now create the EC2.
When creating the EC2, you don't need to set a profile. Configure instance metadata to use both V1 and V2. And put the following code into User-data.
#!/bin/bash
cd /tmp
sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
sudo systemctl enable amazon-ssm-agent
sudo systemctl start amazon-ssm-agentInstalling the Systems Manager Agent on EC2 Linux instances How do I install the AWS Systems Manager Agent (SSM Agent) when launching an Amazon EC2 Linux instance? Last updated: January 31, 2023. When launching an Amazon Elastic Compute Cloud (Amazon EC2) Linux instance — aws.amazon.com
You can confirm no IAM Role is set.
With DHMC enabled, SSM Host Manager recognizes it as a managed node even in this state.
Then go into Session Manager and press Connect — you can confirm it connects. You can also use the CLI as we did above.
Typing yum info amazon-ssm-agent showed the correct version.
Original (Korean): tistory — published 2023-02-28, migrated to this blog. This translation was generated with the help of AI.
…