AWS EC2 SSH Servers
How to integrate with your EC2 SSH Servers with Apono for JIT access
Amazon Elastic Compute Cloud (EC2) is a cloud computing service that provides scalable virtual servers for running applications and workloads. Teams often connect to EC2 instances over SSH to debug, develop, and troubleshoot, but standing SSH access increases the risk of credential sprawl and unauthorized access to critical infrastructure.
You can integrate Amazon EC2 SSH servers with Apono to give your team just-in-time access through access flows. Admins can define which servers users, groups, and shifts can request, along with approval requirements and access durations. When a request is approved, Apono issues a certificate that grants access to the server and adds the requester to the Linux groups that match the requested access. Apono may also use the user's default Linux group.
Prerequisites
Apono Connector
On-prem connection serving as a bridge between an SSH server and Apono:
Minimum Required Version: 1.4.0
Learn how to update an existing AWS, Azure, GCP, or Kubernetes connector.
User with Key Pair Authentication
Dedicated SSH server user account that authenticates with SSH key pairs
In the sudoers file, add the following line to allow Apono to execute commands with sudo privileges without a password prompt.
Apono Secret
Value generated with the credentials of the SSH server user
Create your secret based on your SSH server private key in base64 format.
To find the private key in base64 format, run the following command.
Apono does not store credentials. The Apono connector uses the secret to communicate with services in your environment and separates the Apono web app from the environment for maximal security.
User Groups
(Optional) User groups representing access to the SSH servers
Default: Default
The default represents access to the server with the user's default Linux group.
Integrate AWS EC2 SSH servers
You can also use the steps below to integrate with Apono using Terraform.
In step 11, instead of clicking Confirm, follow the Are you integrating with Apono using Terraform? guidance.
Follow these steps to complete the integration:
On the Catalog tab, click AWS EC2 SSH. The Connect Integration page appears.
Under Discovery, click Next. The Apono connector section expands.
From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.
Click Next. The Integration Config page appears.
Define the Integration Config settings.
Integration Name
Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow
Region
AWS region where your EC2 SSH servers are located
User
User Apono uses to authenticate to your SSH servers
User Groups
(Optional) Names of groups in the server representing the sudoer role
User's Login Shell
(Optional) Command-line interface program used to log in to an account via SSH
User Key Name
(Optional) Filename of the SSH key pair used for authentication
IP Type Preference
(Optional) IP address type Apono uses to connect to your servers:
(Default) Public
Private
Cross Account Role ARN
(Optional) ARN of the role Apono assumes when accessing EC2
servers in another AWS account
Use the format arn:aws:iam::[ACCOUNT_ID]:role/[ROLE_NAME].
Click Next. The Secret Store section expands.
Click Next. The Get more with Apono section expands.
Define the Get more with Apono settings.
Credential Rotation
(Optional) Number of days after which the database credentials must be rotated
Learn more about the Credentials Rotation Policy.
User cleanup after access is revoked (in days)
(Optional) Defines the number of days after access has been revoked that the user should be deleted
Learn more about Periodic User Cleanup & Deletion.
Custom Access Details
(Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.
Integration Owner
(Optional) Fallback approver if no resource owner is found Follow these steps to define one or several integration owners:
From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.
From the Value dropdown menu, select one or multiple users or groups.
NOTE: When Resource Owner is defined, an Integration Owner must be defined.
Resource Owner
(Optional) Group or role responsible for managing access approvals or rejections for the resource Follow these steps to define one or several resource owners:
Enter a Key name. This value is the name of the tag created in your cloud environment.
From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.
NOTE: When this setting is defined, an Integration Owner must also be defined.
(Recommended) Click Test Integration to validate the integration.
Test Integration is available after you have entered or selected values for all required integration fields.
During the test, Apono runs the following validation checks:
Connectivity: The connector can reach the integration.
Configuration: The integration is set up correctly.
Authentication: The credentials are valid.
Discovery: Resources can be fetched.
The Test Validation checklist shows the result of each check.
If a check fails, Apono identifies the failed check and highlights the fields that need correction.
Click Confirm.
Usage
Now that the integration is complete, you can add AWS EC2 SSH to define the resource in an access flow. This allows requesters to securely access secrets stored in your Apono service, based on the access flow’s approval and provisioning rules.
Follow the guidance in these articles to define the resource using AWS EC2 SSH:
Last updated
Was this helpful?