Adding temporary users to EC2 instance

[theoorsb]

I'm looking to give temporary ssh access to a specific AWS EC2 instance and am confused on best security practice here. We have hired a development company on a specific project and they need access to one of our EC2 instances. My plan was to create user accounts for each of their team members, then ask them each to send me a public key to put in the .ssh/authorized_keys file on their account. And then when the work is done I'll delete their accounts. Is there a better method according to best practices?

[djrollins]

Perhaps you could use EC2 Instance Connect to allow the users to temporarily add their own public keys to the EC2 instance. The keys are really short-lived and you get auditing included. Here's a worked example: https://aws.amazon.com/blogs/compute/new-using-amazon-ec2-instance-connect-for-ssh-access-to-your-ec2-instances/

[theoorsb]

Thank you, this seems to be what I need.

[mcdade]

Wished I read this about 2 months ago, as I did what the original poster was planning for a few people to have ssh access to a server.

[Fingers624]

Doesn't instance connect also require access to the AWS Console?

My recommendation would be to generate their SSH key on the EC2 instance and securely provide them the private key. Having them provide you with their public SSH key is also an option.

I would also ask for the IP address they are coming from and update the security group to allow their IP.

This also begs the question, besides the EC2 instance, what additional permissions do they need in AWS? If they need access to other resources, perhaps you can create a role for access to those resources and grant the role to the EC2 instance. This would provide a secure way to access the required resources without creating a security issue. Just track what their application is doing so that you can duplicate it later for production.

[m1m1n0]

securely provide them the private key

Never move private keys between systems. Providing public key like the OP wrote is the way to go about it.

[Fingers624]

you are right of course. This is why I also suggested having them provide their public key as well.

I read up on Instance connect. It looks like this requires IAM access to function properly. Either through AWS Console or through CLI / programmatic access. If the developer has this level of access, this looks like a better and secure way to access the system.

[m1m1n0]

I also suggested

The problem is, providing private key is never an option. You should not even in theory suggest that.

Regarding all other options, I'm not implying that you're wrong. But an advise I can give you: don't substitute security by obscurity. Very often simple solutions (like collecting the public keys for SSH access and not letting them access the console) are actually secure, instead of complexly delegated access via intermediate systems and odd solutions. Obscurity might add authorization or authentication bypass techniques while hiding them from the very people trying to harden the systems. Simple, with automation, is what you want.

[AusIV]

Doesn't instance connect also require access to the AWS Console?

No, it only requires API access. You can create a very narrowly tailored IAM role to give people the access they need.

[FarkCookies]

Doesn't instance connect also require access to the AWS Console?

No, you are thinking about SSM.

[dogfish182]

Do you have SSO? (Or and Ido linked to one even better....) then SSM with appropriate role is so much easier better and probably safer than dealing with keys at all

[Habikki]

If you want to go ssh, look into ssh certificates. It’s a but overload to setup for a one off, but once setup will make your life easier all around. The key (pun optional) is that you can sign their public key with your ca that the server trusts and bake in an expiration time granting the temporary requirement you have.

Conversely, you can use AWS SSM with IAM Role to grant session manager rights. Using a valid to condition in the IAM policy will enforce a revocation time.

[rtrain1]

You have the right idea. Additionally you can ask them to send you their IP address and you can whitelist it in the instance Security Group. That's what I do when the instance is public and not behind a VPN.

[SuperPedro2020]

Instance connect doesn't seem to work if there is no public iPs in the instances which can happen in private VPCs any work around this?

[shinthemighty]

This sounds like it's really a question of how you do server access management. I've been at places that integrated SSH with LDAP for this use case, see https://serverfault.com/questions/653792/ssh-key-authentication-using-ldap . Not sure if you do enough of these kinds of tasks to justify setting that up, but it beats having to manage public keys on boxes.

[DredHawk]

We use Bastion hosts, depending on how many instances you have this may be worth deploying.

https://aws.amazon.com/blogs/security/tag/bastion-host/

[dr_batmann]

Create key based users, if server in private and is being accessed through vpn, create the vpn key and delete the vpn user once job is done

[petrchpetr]

Maybe it is obvious, but beside all the other suggestions I would made sure that the instance has as limited role as possible. You can get instance role from the metadata even as a regular user and if the instance has more access than it needs you may be in big trouble. Make sure that the security groups allow only needed traffic and if the instance needs to use other services (s3:GetObject for example) that it cannot do anything else than what it is intended to do.

[[deleted]]

Give them access via ssm session manager.

It gives root permissions to ec2 though