Amazon-ssm-agent: Port forwarding: simultaneous connections

Created on 13 Apr 2020 · 6Comments · Source: aws/amazon-ssm-agent

Currently, only one connection can be active at a time. This means that if you port-forward an HTTP endpoint, most browsers will either fail or be much slower than expected because they normally open multiple connections and all but the first will block until the socket is closed. It would be nice if this worked like SSH and opened multiple connections as needed.

Source

acdha

👍19

Most helpful comment

yea I agree it's far from ideal, just putting it out here as another possible workaround at the meantime.

m1keil on 14 Oct 2020

👍2

All 6 comments

kefo on 14 Apr 2020

👍1

We ran into this issue trying to access various localhost-bound web consoles like jenkins. The issue was that many of the requests would get stuck indefinitely in a "(pending)" state. We could rely on the browser cache and repeatedly press the refresh button and things would eventually work, most of the time.

The "solution" was to use nginx as a reverse proxy with http2 enabled as http2 multiplexes a single connection for all subsequent requests. Somewhat annoyingly, nginx+http2 requires ssl certificates but we just use self-signed.

e.g. nginx config:

server {
    listen 9001 ssl http2;

    ssl_certificate /etc/ssl/certs/cert.pem;
    ssl_certificate_key /etc/ssl/certs/key.pem;

    location / {
      proxy_pass http://127.0.0.1:8080;
    }
}

The other avenue we explored without any success was to try and get the web-browser to try and only allow a single-connection and serialise all requests so there was only ever a single request. This appears to be possible in firefox but I couldn't get it to work...

mishawakerman on 12 Aug 2020

👍1

Another possible workaround: use AWS-StartSSHSession instead, and utilize the native SSH port forwarding.

Example:

ssh ubuntu@i-04e3d06f42f74c2fe -L 9090:0.0.0.0:9090

More info can be found here.

m1keil on 9 Oct 2020

👍2

@m1keil Yes – we use that heavily but there's a bit more of a learning curve and it's not available to Windows users without additional software (e.g. OpenSSH) so it's in the unfortunate situation where the users who are most impacted also are the least prepared to work around it.

https://github.com/aws/amazon-ssm-agent/releases/tag/3.0.222.0 had the intriguing note about TCP multiplexing but I don't know whether that's sufficient and haven't heard anything from the AWS team.

acdha on 13 Oct 2020

👍2

yea I agree it's far from ideal, just putting it out here as another possible workaround at the meantime.

m1keil on 14 Oct 2020

👍2

Port Forwarding feature now supports multiple simultaneous connections over the session. Please upgrade to latest version of Session Manager Plugin and SSM Agent to use this enhancement. Let us know in case of further issues.

https://aws.amazon.com/about-aws/whats-new/2020/10/port-forwarding-sessions-created-sessions-manager-support-multiple-simultaneous-connections/