AWS SSMでSSHクライアントレス

AWS SSM

寄稿しました。

Amazon Linux2に標準でインストールされていて、クライアントサーバを操作する際にSSHクライアントを使わずにSSMの実行サーバから一斉に処理をかけるといったことが可能です。

環境

OS: Amazon Linux2

EC2構成

SSM実行サーバ
SSM-Manager
SSMクライアント
SSM-Client1
SSM-Client2
SSMクライアントタグ
tag：SSM
value:demo

タグでグループ化します。

EC2 IAMロール

ロール名
EC2-SSM-Role
ポリシー
AmazonEC2RoleforSSM
AmazonEC2FullAccesss

IAMユーザ

プログラム用アクセスユーザ
アクセス権限
AmazonSSMFullAccess

SSMマネージャ設定

SSMの管理用のサーバからコマンドを打てるようにします。

aws configure

ユーザを適用します。

$ aws configure

$ aws configure
AWS Access Key ID [None]: xxxxxxxxxxxx
AWS Secret Access Key [None]: xxxxxxxxxxxxxxxxxxxxxxxxxxx
Default region name [None]: ap-northeast-1
Default output format [None]: json

$ aws configure list

      Name                    Value             Type    Location
      ----                    -----             ----    --------
   profile                <not set>             None    None
access_key     ****************aaaa shared-credentials-file
secret_key     ****************bbbb shared-credentials-file
    region           ap-northeast-1      config-file    ~/.aws/config

一覧取得 SSM管理対象インスタンス

$ aws ssm describe-instance-information --output text

INSTANCEINFORMATIONLIST 2.3.372.0       ip-172.1.45.101.ap-northeast-1.compute.internal        172.1.45.101   i-xxxxxxxxxxxxxxxxx      True    1547987962.59   Online  Amazon Linux    Linux   2       EC2Instance
INSTANCEINFORMATIONLIST 2.3.372.0       ip-172.1.45.102.ap-northeast-1.compute.internal        172.1.45.102   i-aaaaaaaaaaaaaaaaa      True    1547987834.81   Online  Amazon Linux    Linux   2       EC2Instance
INSTANCEINFORMATIONLIST 2.3.372.0       ip-172.1.45.103.ap-northeast-1.compute.internal        172.1.45.103   i-bbbbbbbbbbbbbbbbb      True    1547988067.82   Online  Amazon Linux    Linux   2

これで一覧が取得出来てなかったら、ロールの適用を行えていない可能性が高い。

タグでSSM、値をdemoとグループ化したインスタンスに”df -h”を実行します

$ aws ssm send-command --targets "Key=tag:SSM,Values=demo" --document-name "AWS-RunShellScript" --comment "check volume" --parameters "commands=df -h"


{
    "Command": {
        "MaxErrors": "0",
        "Parameters": {
            "commands": [
                "df -h"
            ]
        },
        "DocumentName": "AWS-RunShellScript",
        "OutputS3BucketName": "",
        "OutputS3KeyPrefix": "",
        "StatusDetails": "Pending",
        "RequestedDateTime": 1548049163.072,
        "Status": "Pending",
        "TargetCount": 0,
        "NotificationConfig": {
            "NotificationArn": "",
            "NotificationEvents": [],
            "NotificationType": ""
        },
        "InstanceIds": [],
        "ErrorCount": 0,
        "MaxConcurrency": "50",
        "ServiceRole": "",
        "CloudWatchOutputConfig": {
            "CloudWatchLogGroupName": "",
            "CloudWatchOutputEnabled": false
        },
        "DocumentVersion": "",
        "CompletedCount": 0,
        "Comment": "check volume",
        "ExpiresAfter": 1548056363.072,
        "DeliveryTimedOutCount": 0,
        "CommandId": "20c3cf30-3e32-4458-89b8-7fe2f34dd793", ←●注目
        "Targets": [
            {
                "Values": [
                    "demo"
                ],
                "Key": "tag:SSM"
            }
        ]
    }
}

コマンドIDから結果を取得出来ます。

$ aws ssm list-command-invocations --command-id 20c3cf30-3e32-4458-89b8-7fe2f34dd793 --details


{
    "CommandInvocations": [
        {
            "Comment": "check volume",
            "Status": "Success",
            "CommandPlugins": [
                {
                    "Status": "Success",
                    "ResponseStartDateTime": 1548049164.141,
                    "StandardErrorUrl": "",
                    "OutputS3BucketName": "",
                    "OutputS3Region": "ap-northeast-1",
                    "OutputS3KeyPrefix": "",
                    "ResponseCode": 0,
                    "Output": "Filesystem      Size  Used Avail Use% Mounted on\ndevtmpfs        476M     0  476M   0% /dev\ntmpfs           493M     0  493M   0% /dev/shm\ntmpfs           493M  328K  493M   1% /run\ntmpfs           493M     0  493M   0% /sys/fs/cgroup\n/dev/xvda1      8.0G  1.2G  6.9G  15% /\n",
                    "ResponseFinishDateTime": 1548049164.149,
                    "StatusDetails": "Success",
                    "StandardOutputUrl": "",
                    "Name": "aws:runShellScript"
                }
            ],
            "ServiceRole": "",
            "CloudWatchOutputConfig": {
                "CloudWatchLogGroupName": "",
                "CloudWatchOutputEnabled": false
            },
            "InstanceId": "i-0e42fcc335e570cf6",
            "DocumentName": "AWS-RunShellScript",
            "NotificationConfig": {
                "NotificationArn": "",
                "NotificationEvents": [],
                "NotificationType": ""
            },
            "DocumentVersion": "",
            "StatusDetails": "Success",
            "StandardOutputUrl": "",
            "StandardErrorUrl": "",
            "InstanceName": "ip-172.1.45.102.ap-northeast-1.compute.internal",
            "CommandId": "20c3cf30-3e32-4458-89b8-7fe2f34dd793",
            "RequestedDateTime": 1548049163.705
        },
        {
            "Comment": "check volume",
            "Status": "Success",
            "CommandPlugins": [
                {
                    "Status": "Success",
                    "ResponseStartDateTime": 1548049164.062,
                    "StandardErrorUrl": "",
                    "OutputS3BucketName": "",
                    "OutputS3Region": "ap-northeast-1",
                    "OutputS3KeyPrefix": "",
                    "ResponseCode": 0,
                    "Output": "Filesystem      Size  Used Avail Use% Mounted on\ndevtmpfs        476M     0  476M   0% /dev\ntmpfs           493M     0  493M   0% /dev/shm\ntmpfs           493M  328K  493M   1% /run\ntmpfs           493M     0  493M   0% /sys/fs/cgroup\n/dev/xvda1      8.0G  1.2G  6.9G  15% /\n",
                    "ResponseFinishDateTime": 1548049164.069,
                    "StatusDetails": "Success",
                    "StandardOutputUrl": "",
                    "Name": "aws:runShellScript"
                }
            ],
            "ServiceRole": "",
            "CloudWatchOutputConfig": {
                "CloudWatchLogGroupName": "",
                "CloudWatchOutputEnabled": false
            },
            "InstanceId": "i-07360cdbd8b0e4aea",
            "DocumentName": "AWS-RunShellScript",
            "NotificationConfig": {
                "NotificationArn": "",
                "NotificationEvents": [],
                "NotificationType": ""
            },
            "DocumentVersion": "",
            "StatusDetails": "Success",
            "StandardOutputUrl": "",
            "StandardErrorUrl": "",
            "InstanceName": "ip-172.1.45.103.ap-northeast-1.compute.internal",
            "CommandId": "20c3cf30-3e32-4458-89b8-7fe2f34dd793",
            "RequestedDateTime": 1548049163.572
        }
    ]
}

ssm-sh

goのインストール

$ vi /home/ec2-user/.bashrc

# .bashrc

# Source global definitions
if [ -f /etc/bashrc ]; then
        . /etc/bashrc
fi

# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=

# User specific aliases and functions

※下記を追加

export GOPATH=$HOME/go
export PATH=$PATH:$GOROOT/bin:$GOPATH/bin

$ source ~/.bashrc

ssm-shのインストール

$ sudo yum install -y git
$ go get -u github.com/itsdalmo/ssm-sh

OSSなので自己責任でお願いします。

SSM-SHのインストールの確認

$ ssm-sh --help


Usage:
  ssm-sh [OPTIONS] <command>

Application Options:
  -v, --version  Print the version and exit.

AWS Options:
  -p, --profile= AWS Profile to use. (If you are not using Vaulted).
  -r, --region=  Region to target.

Help Options:
  -h, --help     Show this help message

Available commands:
  describe  Description a document from ssm.
  list      List managed instances or documents. (aliases: ls)
  run       Run a command or document on the targeted instances.
  shell     Start an interactive shell. (aliases: sh)

ヘルプが出てきたらOK

インスタンスに入ってコマンドの実行

$ ssm-sh -r ap-northeast-1 shell -t i-aaaaaaaaaaaaaaaa

Initialized with targets: [i-aaaaaaaaaaaaaaaa]
Type 'exit' to exit. Use ctrl-c to abort running commands.

≫ pwd

i-aaaaaaaaaaaaaaaa - Success:
/usr/bin


≫ whoami

i-aaaaaaaaaaaaaaaa - Success:
root


≫ ping -c 3 yahoo.co.jp

i-0e42fcc335e570cf6 - Success:
PING yahoo.co.jp (183.79.135.206) 56(84) bytes of data.
64 bytes from f1.top.vip.kks.yahoo.co.jp (183.79.135.206): icmp_seq=1 ttl=39 time=14.6 ms
64 bytes from f1.top.vip.kks.yahoo.co.jp (183.79.135.206): icmp_seq=2 ttl=39 time=14.6 ms
64 bytes from f1.top.vip.kks.yahoo.co.jp (183.79.135.206): icmp_seq=3 ttl=39 time=15.1 ms


≫ exit
$

SSMを利用するとクライアントサーバに致してSSHクライアントレスでコマンドを打つことが可能です。

お疲れ様です。

コマンドライン
https://d1.awsstatic.com/events/jp/2017/summit/slide/D3T3-6.pdf
https://dev.classmethod.jp/articles/manage-instance-by-ec2-run-command-only/