Amazon EC2 Instance Connect Specialized2008年〜
A service for securely connecting to EC2 instances without pre-distributing SSH keys
What It Does
Amazon EC2 Instance Connect lets you securely connect to EC2 instances without pre-distributing or managing SSH key pairs. It pushes a temporary SSH public key to the instance metadata, establishing a connection valid for only 60 seconds. Access is controlled through IAM policies, and connection logs are recorded in CloudTrail.
Use Cases
It is used when developers need to connect to EC2 instances for troubleshooting, or when you want to simplify SSH key management. Browser-based connections are also available, so you can connect even without a local SSH client.
Everyday Analogy
Think of it like a hotel key card system. When a guest (developer) verifies their identity at the front desk (IAM), a key card (temporary SSH key) valid only for their stay is issued. The key card becomes invalid after checkout, eliminating the risk of lost keys.
What Is EC2 Instance Connect?
EC2 Instance Connect is a service that balances SSH connection security with convenience. Traditional SSH connections required managing private key files, but Instance Connect automatically generates temporary keys based on IAM authentication. You can also open a terminal directly in your browser from the AWS Management Console.
Connection Methods
There are three connection methods: browser-based connection from the AWS Management Console, using the ec2-instance-connect command in the AWS CLI, and combining with a standard SSH client. In all cases, only users authorized by IAM policies can access instances, and connection events are recorded in CloudTrail. For detailed implementation of connection methods, books (Amazon) also provide thorough coverage.
Getting Started
Simply select an instance in the EC2 console and click the 'Connect' button. By creating an Instance Connect Endpoint in your VPC, you can connect to instances in private subnets without a public IP. You need to configure the security group to allow SSH from the Instance Connect IP range.
Things to Watch Out For
- Instance Connect is supported on Amazon Linux 2 and Ubuntu 16.04 and later. It does not support Windows instances
- Connecting to instances in private subnets requires creating an Instance Connect Endpoint
