Terraform(AWS) EC2 and SSM (Aws System Manager)

In this tutorial I will show how to write Ec2 using terraform and access it through AWS SSM. Here I am using the Ubuntu OS.

When we need access from Aws System Manager ?

When we launch all our infrastructure or ec2 in the private subnet of VPC which doesn’t have public ip or public domain and have only internet access through NAT. and at that time we have only one option to access the ec2 in private subnet. i.e Through Jumper ec2 with public IP or SSM

I will divide it in three steps

1. Create Ec2 and install ssm-agent
2. Create IAM role, and attach ec2-profile and AmazonSSMManagedInstanceCore policy to the role
3. Test or Access Ec2 from Aws System Manager
4. Create Ec2 and install ssm-agent

Before creating ec2 write the script that download and install ssm-agent as follows filename of my script is ssm-agent-install.sh

#!/bin/bash
sudo mkdir /tmp/ssm
cd /tmp/ssm
wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb
sudo dpkg -i amazon-ssm-agent.deb
sudo systemctl enable amazon-ssm-agent
rm amazon-ssm-agent.deb

Create Ec2 using as follows. Here I am creating aws_security_group that allows web-port as well as ssh port and I am launching this ec2 in public subnet so it will have ssh access too.

but ssh port is not necessary while accessing from AWS system manager you can delete ssh allow from security group

# put ssh-public key here , if you need ssh access

resource "aws_key_pair" "ITKey" {
 key_name   = "kd"
 public_key = "ssh-rsa ............"
}
data "template_file" "startup" {
 template = file("ssm-agent-installer.sh")
}

resource "aws_security_group" "allow_web" {
name        = "webserver"
vpc_id      = module.it_internal_vpc.vpc_id
description = "Allows access to Web Port"
#allow http 
ingress {
from_port   = 80
to_port     = 80
protocol    = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# allow https
ingress {
from_port   = 443
to_port     = 443
protocol    = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# allow SSH
ingress {
from_port   = 22
to_port     = 22
protocol    = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
#all outbound
egress {
from_port   = 0
to_port     = 0
protocol    = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
stack = "test"
}
lifecycle {
create_before_destroy = true
}
} #security group ends here
resource "aws_instance" "ec2" {
 ami                    = "ami-0b418580298265d5c"
 instance_type          = "t2.nano"
 subnet_id              = module.it_internal_vpc.public_subnets[1]
 vpc_security_group_ids = [aws_security_group.allow_web.id]
 iam_instance_profile = aws_iam_instance_profile.dev-resources-iam-  profile.name 
 key_name               = aws_key_pair.ITKey.key_name
root_block_device {
delete_on_termination = true
volume_type           = "gp2"
volume_size           = 20
}
tags = {
 Name                   = "test-ec2"
 owner                  = "Khimanand.oli@gmail.com"
 stack                  = "test"
}
user_data = data.template_file.startup.rendered
}

2. Create IAM role, and attach ec2-profile and AmazonSSMManagedInstanceCore policy to the role

resource "aws_iam_instance_profile" "dev-resources-iam-profile" {
name = "ec2_profile"
role = aws_iam_role.dev-resources-iam-role.name
}
resource "aws_iam_role" "dev-resources-iam-role" {
name        = "dev-ssm-role"
description = "The role for the developer resources EC2"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": {"Service": "ec2.amazonaws.com"},
"Action": "sts:AssumeRole"
}
}
EOF
tags = {
stack = "test"
}
}
resource "aws_iam_role_policy_attachment" "dev-resources-ssm-policy" {
role       = aws_iam_role.dev-resources-iam-role.name
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

3. Test or Access Ec2 from Aws System Manager

Final step is test accessing your ec2 from AWS System Manager

Go to AWS System Manager

finally start the session, you will get the terminal.