Access EC2 Instances Deployed in Private Subnets Leveraging Bastion Hosts. A Step-by-Step Guide.
Tags: aws, networking, cloud, beginners
Published: 2024-03-22 17:04:52

**NOTE THAT IN THIS SCENARIO, I AM ASSUMING YOU ALREADY HAVE AN INSTANCE DEPLOYED IN THE PRIVATE SUBNET THAT YOU NEED TO ACCESS.
PLEASE MAKE SURE YOU ALSO HAVE ACCESS TO THE KEY PAIR OF YOUR PRIVATE RESOURCE.**

To connect to an EC2 instance in a private subnet on AWS using a bastion host, kindly follow these steps:


**Step 1: Launch Bastion Host**

Launch an EC2 instance in a public subnet. This instance will act as the bastion host. Ensure that it has a public IP address and is accessible from the internet.

As you can see below I have both of my instances launched in the same vpc, different availability zones and just one instance with a publicly accessible IP address. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k1ru6650auexkd8kewpi.png)


**Step 2: Configure Security Groups**

Copy the private IP of the bastion host and private resource instance to your notepad or any text editor and name accordingly.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6y88ez6zi5vkaf0fp9lx.png)


Configure the security group of the private resource instance to allow SSH (port 22) access from your instance in the public subnet for restricted purposes by editing the inbound rules.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qa73csuln4kgto2x6l8d.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ylsnlj2zmdvpfz5hswwd.png)

Click Save rules to save changes.

**Step 3: Editing your pem key**

Locate the pem key of your private instance and click on open with notepad, vscode or any editor of your choice.

Below is an image of what the pem key should look like once open, That's half of mine to prevent security issues


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/55qnmactwb2w7u16dh7t.png)


**Step 4: Connect to the Bastion Host**

Use AWS SSM to connect to the bastion host.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gp5j4xiop3lc6x5encl8.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wmmm78qtiaxma30yun6o.png)


You should see a new tab pop up and a terminal opened up for you on the AWS console.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dxd2blldrz99ue3cv1iw.png)


**Step 5: Saving your pem key to your Bastion host instance**

Run the following commands as follows:

**1. sudo su** (gives super user priviledges)

**2. cd /home** (locates and opens the home directory)

**3. cd ec2-user** (locates and opens the ec2-user directory)

**4. touch private.pem** (This will create a file called private.pem)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nmlue97ib4at402v6s1u.png)


**5. nano private.pem** (this will open a text editor to edit the file created by the touch private.pem command)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3zmsztud5yqkj03iq4q6.png)

Go back to the notepad or vscode opened on your computer earlier and copy all the content of your pem key(Every single word).

Paste into the nano editor of your Bastion host.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iom4kh26wc62s1rsowxp.png)


Again I've blocked out some part of my key for security reasons, after pasting the pem key details click on **CtrlX** followed by **y** and finally the **Enter key**


**Step 6: Logging into your private Instance**

While still on your bastion host terminal, run the command 

**1. chmod 0400 private.pem.**

**2. ssh -i private.pem ec2-user@172.16.87.100(The private IP of your Private resource)**

which according to the IP I copied earlier should be **172.31.66.236** and translates to :

 **ssh -i private.pem ec2-user@172.31.66.236**.

You'll be greeted with a prompt asking you to verify the key authenticity, just type **yes** and **Enter key**.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7i361w08kxdzbln3fhuc.png)


If you get the same result as the Image above then congratulations you just logged into your instance using the Bastion host or Jumper method.

You might be wondering where this would be useful in a realife scenario and I'll be explaining why in next weeks blog post.

**Please remember to disable and delete all resources after use so as to not incure cost on your AWS account.**