1

I'm planning to use AWS EC2 instances for the development purpose of my web application. So, I will like to disable all the outbound ports except RDP(3389) port. The RDP port will only be open to a particular AWS Service(host). Users can access the host only after logging into AWS Console.

Can anyone please help me understand if there is any service in AWS that can be used as the host?

For reference, Azure has a Bastion Host, which can be used for this purpose.

2

There're many ways to access its EC2 instances as we know and if you want let the users access the instance only through AWS Console, then you might want to use AWS SSM (System manager), which will allow the user access only the authorised EC2 instances without Bstion host by the given IAM policy.

Here's instruction that you can consider as below:

  1. Install and verify its SSM agent on the Windows or Linux instance. See Manually install SSM Agent on EC2 instances for Windows Server

  2. Set a given IAM policy belong to the users or group. Refer to Additional sample IAM policies for Session Manager.

  • You can either restrict access based on instance tags or specific instances-id, Just pick one that you want to.

An example of user IAM policy as following:

{
    "Sid": "ssmpolicy",
    "Effect": "Allow",
    "Action": "ssm:StartSession",
    "Resource": "arn:aws:ec2:eu-west-1:xxxxxxxxx:instance/*",
    "Condition": {
        "StringLike": {
            "ssm:resourceTag/Name": [
                 "Instance_app_1",
                 "Instance_app_2"
            ]
         }
     }
}
  1. Lastly, set EC2 IAM Role for the instance with AmazonSSMManagedInstanceCore managed policy by AWS.

Then you're good to go safely. Connecting its Windows instance on AWS Console is pretty easy. Please take a look by visitng Connect to a Windows instance using Session Manager

When a user access the EC2 via AWS console, a prompt will be appears like in the picture, and then can access if IAM Role and policy has been given properly in each instance and the users.

enter image description here

1

You can define security groups in AWS. later you can attach these security groups to instances.

REFERENCE : https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.