Amazon-ssm-agent: Feature Request: ftp via session manager

[e-moshaya]

Now that we can use ssm to start remote sessions, we would love a way to also use ssm for ftp files and folders onto instance.

[kellertobias]

I'd also love to be able to transfer files via ssm. In this way we could replace ssh for our entire cloud environment (at the moment we sometimes need to transfer certificates or configuration files/ backups via scp)

[thedevopsmachine]

You could quite easily build this yourself. Create a custom SSM Document that takes a PresignedUrl and a TargetFile parameter (and optionally a DeleteFromSource parameter) that will download it to the specified location (and optionally delete it afterwards). When you want to transfer a file, you upload it to S3, generate a presigned URL, then invoke the document via RunCommand.

You could also replace the pre-signed URL part with a bucket and a key parameter, but then you have to ensure that the instance has access to the bucket, which may or may not be desirable. Since the parameters are logged in the RunCommand history, if you're transferring sensitive data, you'd probably want to use the bucket/key option, and enable KMS SSE on the bucket. You'd need to make sure that the instances you're running it on have kms:Decrypt access to the KMS key.

If you're only transferring small files like certificates and config files (i.e. less than 4KB), you could write a document that takes a "Base64Content" parameter, then in your client code you could read the file as a byte array, use KMS to encrypt it, then convert it to a base64 string and invoke RunCommand with that as the input Your the document would then use KMS to decrypt the parameter value, then write the plaintext byte array to the target file. This eliminates the use of S3, but would limit your file size to 4KB (max KMS will let you encrypt). If your file isn't sensitive, you could probably skip the KMS part and just use Base64. I use this method myself in a certificate request signing document.

[e-moshaya]

@thedevopsmachine that is so much effort and hassle to get a file onto an instance... What about folders? or transferring files from the instance? This is a feature request to get SSM to support SCP/RCP which is essential for any platform. Session Manager has been released and has been described as the Bastion host killer. However, without scp support, I still see a requirement for basion hosts. This is a feature request to update SSM to support FTP without the need for additional steps or resources to support the functionality.

[thedevopsmachine]

The S3 API's allow you to upload/download folders from S3. See https://docs.aws.amazon.com/cli/latest/reference/s3/cp.html and note the --recursive property. You can switch between uploading and downloading files based on the order in which you supply the source/destination parameters.

I'm not suggesting that the SSM team ignore this by any means. A native means to do this would certainly be a better experience. I was simply suggesting something that you can do today to solve that particular problem yourself. If the only reason you still need a bastion host is to transfer a file/folder to an instance, the extra hassle involved in uploading files so that you can decommission your bastions might be worthwhile.

[e-moshaya]

@thedevopsmachine thank you for your helpful suggestions. I am already familiar with all your suggested workarounds and I'm sure they will be helpful for other people who are looking for solutions.

[ricosega]

With this feature it would be really possible to get rid of bastion hosts.

[ericfrederich]

Even with an ability to scp files it would not replace SSH.
What about tunnels and port forwarding?

[achimnol]

@ericfrederich I think those features may be replaced with AWS Client VPN. I also love such versatility of the SSH protocol, but can bear with SSM because it lifts most maintainence efforts from me.

[TomGMan]

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html
https://aws.amazon.com/about-aws/whats-new/2019/07/session-manager-launches-tunneling-support-for-ssh-and-scp/
This is now possible.

[ericfrederich]

Yes @TomGMan, I have tested it with port forwarding.
Crazy stuff. You can have an EC2 sitting somewhere with no inbound access at all, no ports open, etc... and you can use it as a jump host to forward ports to other machines within the VPC.