Part of:Manage AWS EC2 instances from creation to deployment
How to avoid 4 common errors in EC2 Instance Connect
The EC2 Instance Connect feature enables users to securely connect instances, but there are certain pitfalls to avoid. Here are some issues to look out for.
The Amazon EC2 Instance Connect feature delivers additional security and flexibility to the usual way users connect to EC2 instances. To make the most of it, a team will need to be aware of common problems that can arise.
To connect to an EC2 instance, users typically needed a SSH client in their terminal plus a private EC2 key file assigned to the EC2 instance at launch. With EC2 Instance Connect, users can achieve the same result using the AWS console, without necessarily having the EC2 private key file available.
From the EC2 console, users can select a particular EC2 instance and use the Connect feature. If the instance's settings are correct, the EC2 console connects to it and it launches a screen that resembles a terminal connected via SSH.
With the right configurations in place, EC2 Instance Connect helps AWS users control how they connect to EC2 instances. Let's look at common errors you might encounter when using EC2 Instance Connect and how to avoid them.
Missing Amazon Machine Image. Users need to have in place an Amazon Machine Image (AMI) that supports EC2 Connect -- or must install one in an instance you want users to connect to. Also, the instance must have a version of the systems manager agent that supports EC2 Connect. If you do not meet these prerequisites, the EC2 console displays a descriptive error message. To avoid this error, install the missing software dependencies in the EC2 instance.
Misconfigured security. Another common problem is to assign a misconfigured security group to the target EC2 instance. The security group must be configured to allow incoming SSH traffic on Port 22 for the IP range assigned to the EC2 Instance Connect feature. See EC2_INSTANCE_CONNECT in the published AWS IP ranges for each region, and verify the security group allows incoming traffic from that IP range on Port 22.
Insufficient AWS IAM permissions. When using the EC2 console or a regular SSH client, users need appropriate AWS Identity and Access Management (IAM) permissions to execute the operation ec2-instance-connect:SendSSHPublicKey. If users try the EC2 Instance Connect Command Line Interface, they'll also need ec2:DescribeInstances. Sometimes users have permissions only on "ec2:*" actions, so ec2-instance-connect may not be included in the IAM policy assigned to users trying to connect.
With the right configurations in place, EC2 Instance Connect helps AWS users control how they connect to EC2 instances.
No public IP assigned to the target EC2 instance. When using the EC2 Instance Connect feature from the EC2 console, the target EC2 instance must have a public IP assigned and a security group that enables incoming traffic for the IP range assigned to the EC2 Connect feature, as mentioned above.
If EC2 instances only have a private IP, developers can use the EC2 Instance Connect CLI or a regular SSH client, but they have to do it from a server that has access to the private IP of the target EC2 instance. To do so, connect from an EC2 instance deployed in the same VPC as the target or within a peering VPC. You can also use a VPN client with access to the target instance's VPC or use AWS PrivateLink. In all cases, make sure that the target EC2 instance has a security group that allows incoming traffic from the server where the connection is initiated.
