🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🔑 धडा 06 — Connecting: एक चावी, एका मिनिटाचा पास, किंवा दारच नाही

📍 तुम्ही इथे आहात: 12 पैकी धडा 06 · मागे: lesson-05-networking · पुढे: lesson-07-metadata-roles

📦 या ब्रँचमध्ये काय आहे

धडे 01–05, आणि डेस्कवर shell मिळवण्याचे तीन मार्ग — key pair सह SSH, EC2 Instance Connect आणि Session Manager — त्यांना लागणारा port, लागणारी key, आणि ते मागे ठेवणारा audit trail यांची तुलना. इथे भाग 1 संपतो: डेस्क भाड्याने घेणे.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

काहीतरी बदलायला तुम्हाला तुमच्या डेस्कपर्यंत पोहोचायचे आहे. तीन मार्ग:

धातूची चावी 🔑 (एक SSH key pair). तुमच्यासाठी दार (port 22) उघडे ठेवावे लागते, आणि तुमच्या चावीची नक्कल करणारा कोणीही आत येतो. ती हरवली तर तुम्ही बाहेरच अडकता; ती वाटली तर कोण आत आले ते कोणालाच कळत नाही.
एका मिनिटाचा पास 🎫 (EC2 Instance Connect). पुढचे office आधी तुम्ही कोण आहात ते तपासते, मग दारावर 60 सेकंद चालणारा नवा पास लावते. दार तरीही उघडे असावे लागते — पण हरवायला चावी नाही, आणि कोणी मागितले ते office लिहून ठेवते.
दारच नाही 📞 (Session Manager). डेस्कवर एक phone आहे जो पुढच्या office ला बाहेर call करतो. तुम्हाला आत यायचे असेल, तेव्हा office तुमचा badge तपासते आणि त्याच line वर तुम्हाला जोडते. उघडे दार नाही, चावी नाही, आणि प्रत्येक call ची नोंद होते.

खऱ्या कोणत्याही कामासाठी शाळा क्रमांक 3 निवडते.

🗺️ आकृती

flowchart LR
    you["🧑‍💻 you"]
    ssh["🔑 SSH + key pair<br/>port 22 open to your IP · a .pem to guard"]
    eic["🎫 EC2 Instance Connect<br/>IAM pushes a 60-second key · port 22 still open"]
    ssm["📞 Session Manager<br/>no inbound port · IAM decides · logged"]
    desk["🖥️ desk"]
    agent["SSM Agent calls out on 443"]
    you -->|"1"| ssh --> desk
    you -->|"2"| eic --> desk
    you -->|"3"| ssm
    agent -->|"outbound only"| ssm
    ssm --> desk

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/ec2/lesson-diagrams.html#l06

❓ काय

Key pair — AWS public key ठेवते आणि launch वेळी ती instance वर टाकते; private key तुम्ही ठेवता (.pem, chmod 400). Login user AMI वर अवलंबून असतो: Amazon Linux वर ec2-user, Ubuntu वर ubuntu. त्यासाठी network path आणि SG व NACL मध्ये port 22 उघडा असावा लागतो.
EC2 Instance Connect — IAM नियंत्रित: API एक public key टाकते जी 60 सेकंद चालते, मग तुम्ही नेहमीसारखे SSH करता. तरीही port 22 लागतो (browser console साठी: AWS च्या EC2 Instance Connect address range साठी उघडा). EC2 Instance Connect Endpoint public IP नसलेल्या private subnets मधल्या instances पर्यंत पोहोचतो.
Session Manager (AWS Systems Manager चा भाग) — instance वरचा SSM Agent (Amazon Linux 2023 आणि अनेक AMIs वर आधीच installed) Systems Manager कडे outbound HTTPS connection करतो. तुम्हाला AmazonSSMManagedInstanceCore policy असलेले instance profile लागते (धडा 07), आणि SSM endpoints कडे outbound 443 (किंवा private subnets साठी VPC endpoints). Inbound नियम नाही, key नाही. Sessions ना IAM परवानगी देते, CloudTrail मध्ये नोंद होते, आणि त्यांचे S3 किंवा CloudWatch मध्ये log ठेवता येतात. ते port forwarding सुद्धा करते.
EC2 Serial Console — networking किंवा boot च बिघडलेले असेल तेव्हाचा शेवटचा उपाय; default नुसार बंद, प्रत्येक account साठी चालू करावा लागतो.

🤔 का

कारण उघडा port 22 हे internet वरचे सर्वात जास्त scan होणारे दार आहे, आणि shared folder मधली .pem file ही incident reviews मधला सर्वात नेहमीचा "हे कोणी केले?" प्रश्न आहे. Session Manager दोन्ही काढून टाकतो: scan करायला काही नाही, फुटायला काही नाही, आणि प्रत्येक command चा log.

🔧 कसे (या repo मध्ये)

ec2/demo.py मधले connect() तिन्ही मार्ग शेजारी-शेजारी छापते. खालचा snippet Session Manager ची रचना दाखवण्यासाठी ec2/sg.py वापरतो: एकही inbound नियम नसलेला security group सुद्धा agent चा outbound call जाऊ देतो, कारण default outbound नियम त्याला परवानगी देतो.

🧪 करून पाहा

python3 ec2/demo.py connect
python3 - <<'EOF'
import sys; sys.path.insert(0, "ec2")
from sg import SecurityGroup
# the Session Manager desk: NO inbound rules at all — it only calls out on 443
ssm_desk = SecurityGroup("sg-ssm-only", [])
print("SSH from the office:", ssm_desk.receive("tcp", "203.0.113.5", 50123, 22))
print("agent calls out to SSM:", ssm_desk.reply("tcp", "192.0.2.10", 443, 50124))
EOF

खऱ्या account वर (AWS credentials आणि चालू instance लागतो; Session Manager साठी AWS CLI चा Session Manager plugin सुद्धा लागतो):

chmod 400 school-key.pem
ssh -i school-key.pem ec2-user@ec2-203-0-113-25.compute-1.amazonaws.com
aws ec2-instance-connect send-ssh-public-key --instance-id i-0123456789abcdef0 \
    --instance-os-user ec2-user --ssh-public-key file://$HOME/.ssh/id_ed25519.pub
aws ssm start-session --target i-0123456789abcdef0

✅ तपासा — तुम्हाला काय दिसायला हवे

connect तीन ओळी छापते: SSH with a key pair port: 22 open (to your IP) / key: a .pem you must guard / audit: only the OS log; EC2 Instance Connect a one-minute key pushed by IAM आणि CloudTrail सह; Session Manager port: none — the agent calls out, key: none — IAM decides, audit: CloudTrail + session logs सह — मग for anything real: Session Manager, and a security group with no port 22 at all. तुमचा snippet छापतो SSH from the office: (False, 'sg-ssm-only: no inbound rule matches — dropped (the sender sees a timeout)') आणि agent calls out to SSM: (True, "sg-ssm-only: outbound rule 'default: all out'").

🏁 तुम्ही आत्ताच काय सिद्ध केले

शून्य inbound नियम असलेला डेस्कही पूर्णपणे सांभाळता येतो: आत जाण्याचा मार्ग म्हणजे एक outbound call आणि IAM चा निर्णय, उघडे दार आणि चावी नाही.

⚠️ नेहमीच्या चुका

एकच .pem अनेक लोकांमध्ये वाटणे — कोणालाच काढता येत नाही आणि कोणीच जबाबदार राहत नाही
चुकीच्या user ने ssh करणे (root, किंवा Ubuntu वर ec2-user) → Permission denied (publickey)
Session Manager "चालत नाही" कारण instance ला AmazonSSMManagedInstanceCore असलेला role नाही, किंवा SSM endpoints कडे outbound मार्ग नाही
"फक्त test साठी" 22 0.0.0.0/0 साठी उघडणे आणि तो कधीच बंद न करणे
instance ची एकमेव private key हरवणे — recovery ची योजना करा (Session Manager, किंवा stop आणि volume swap करून नवी key)

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: अनेक संस्था inbound 22 पूर्णपणे बंदच ठेवतात (AWS Config rules आणि SCPs ने लागू केलेले) आणि session logging सह Session Manager वापरतात — engineers IAM मधून आत जातात, आणि auditors ना प्रत्येक session ची नोंद मिळते.

⏭️ पुढे

भाग 2 सुरू होतो: fleet चालवणे. आधी, प्रत्येक डेस्क "मी कोण?" विचारू शकतो — आणि त्याला keys ऐवजी एक badge मिळतो. Metadata आणि roles.

git checkout lesson-07-metadata-roles

🔑 Lesson 06 — Connecting: a key, a one-minute pass, or no door at all

📍 You are here: Lesson 06 of 12 · Previous: lesson-05-networking · Next: lesson-07-metadata-roles

📦 What's in this branch

Lessons 01–05, plus the three ways to get a shell on a desk — SSH with a key pair, EC2 Instance Connect and Session Manager — compared on the port they need, the key they need, and the audit trail they leave. This ends Part 1: renting a desk.

🧒 Explain like I'm 5

You need to get to your desk to change something. Three ways:

A metal key 🔑 (an SSH key pair). The door (port 22) must stay open for you, and anyone who copies your key gets in too. Lose it and you are locked out; share it and nobody knows who came in.
A one-minute pass 🎫 (EC2 Instance Connect). The front office checks who you are, then pins a fresh pass on the door that works for 60 seconds. The door still has to be open — but there is no key to lose, and the office writes down who asked.
No door at all 📞 (Session Manager). The desk has a phone that calls out to the front office. When you want in, the office checks your badge and puts you through on that line. No open door, no key, and every call is recorded.

For anything real, the school picks number 3.

🗺️ Diagram

flowchart LR
    you["🧑‍💻 you"]
    ssh["🔑 SSH + key pair<br/>port 22 open to your IP · a .pem to guard"]
    eic["🎫 EC2 Instance Connect<br/>IAM pushes a 60-second key · port 22 still open"]
    ssm["📞 Session Manager<br/>no inbound port · IAM decides · logged"]
    desk["🖥️ desk"]
    agent["SSM Agent calls out on 443"]
    you -->|"1"| ssh --> desk
    you -->|"2"| eic --> desk
    you -->|"3"| ssm
    agent -->|"outbound only"| ssm
    ssm --> desk

🗺️ Drawn version + a lab: https://school-edh.pages.dev/ec2/lesson-diagrams.html#l06

❓ What

Key pair — AWS keeps the public key and puts it on the instance at launch; you keep the private key (.pem, chmod 400). The login user depends on the AMI: ec2-user on Amazon Linux, ubuntu on Ubuntu. Needs a network path and port 22 open in the SG and NACL.
EC2 Instance Connect — IAM-controlled: the API pushes a public key that is valid for 60 seconds, then you SSH as normal. Still needs port 22 (for the browser console: open to AWS's EC2 Instance Connect address range). EC2 Instance Connect Endpoint reaches instances in private subnets with no public IP.
Session Manager (part of AWS Systems Manager) — the SSM Agent on the instance (pre-installed on Amazon Linux 2023 and many AMIs) makes an outbound HTTPS connection to Systems Manager. You need an instance profile with the AmazonSSMManagedInstanceCore policy (lesson 07), and outbound 443 to the SSM endpoints (or VPC endpoints for private subnets). No inbound rule, no key. Sessions are authorised by IAM, recorded in CloudTrail, and can be logged to S3 or CloudWatch. It also does port forwarding.
EC2 Serial Console — a last resort when networking or the boot itself is broken; off by default, enabled per account.

🤔 Why

Because an open port 22 is the most-scanned door on the internet, and a .pem file in a shared folder is the most common "who did this?" in incident reviews. Session Manager removes both: nothing to scan, nothing to leak, and a log of every command.

🔧 How (in this repo)

connect() in ec2/demo.py prints the three ways side by side. The snippet below uses ec2/sg.py to show the Session Manager shape: a security group with no inbound rules at all still lets the agent's outbound call through, because the default outbound rule allows it.

🧪 Try it

python3 ec2/demo.py connect
python3 - <<'EOF'
import sys; sys.path.insert(0, "ec2")
from sg import SecurityGroup
# the Session Manager desk: NO inbound rules at all — it only calls out on 443
ssm_desk = SecurityGroup("sg-ssm-only", [])
print("SSH from the office:", ssm_desk.receive("tcp", "203.0.113.5", 50123, 22))
print("agent calls out to SSM:", ssm_desk.reply("tcp", "192.0.2.10", 443, 50124))
EOF

On a real account (needs AWS credentials and a running instance; Session Manager also needs the Session Manager plugin for the AWS CLI):

chmod 400 school-key.pem
ssh -i school-key.pem ec2-user@ec2-203-0-113-25.compute-1.amazonaws.com
aws ec2-instance-connect send-ssh-public-key --instance-id i-0123456789abcdef0 \
    --instance-os-user ec2-user --ssh-public-key file://$HOME/.ssh/id_ed25519.pub
aws ssm start-session --target i-0123456789abcdef0

✅ Verify — what you should see

connect prints three rows: SSH with a key pair port: 22 open (to your IP) / key: a .pem you must guard / audit: only the OS log; EC2 Instance Connect with a one-minute key pushed by IAM and CloudTrail; Session Manager with port: none — the agent calls out, key: none — IAM decides, audit: CloudTrail + session logs — then for anything real: Session Manager, and a security group with no port 22 at all. Your snippet prints SSH from the office: (False, 'sg-ssm-only: no inbound rule matches — dropped (the sender sees a timeout)') and agent calls out to SSM: (True, "sg-ssm-only: outbound rule 'default: all out'").

🏁 What you just proved

A desk can be fully manageable with zero inbound rules: the way in is an outbound call plus an IAM decision, not an open door and a key.

⚠️ Common mistakes

sharing one .pem between people — nobody can be removed and nobody is accountable
ssh as the wrong user (root, or ec2-user on Ubuntu) → Permission denied (publickey)
Session Manager "not working" because the instance has no role with AmazonSSMManagedInstanceCore, or no outbound path to the SSM endpoints
opening 22 to 0.0.0.0/0 "just to test" and never closing it
losing the only private key for an instance — plan recovery (Session Manager, or a new key via a stop and a volume swap)

🏭 Why this matters in production: many organisations forbid inbound 22 entirely (enforced by AWS Config rules and SCPs) and use Session Manager with session logging — engineers get in through IAM, and auditors get a record of every session.

⏭️ Next

Part 2 begins: running a fleet. First, every desk can ask "who am I?" — and gets a badge instead of keys. Metadata and roles.

git checkout lesson-07-metadata-roles

← Previousnetworking Next →metadata roles

This page is the lesson's README from the lesson-06-connecting branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.