Secure Remote Access - EC2 Instance Connect Endpoint
Tags: aws, networking, ec2
Published: 2023-06-19 20:13:21

AWS recently launched a new feature called Amazon [EC2 Instance Connect (EIC) Endpoint](https://aws.amazon.com/about-aws/whats-new/2023/06/amazon-ec2-instance-connect-ssh-rdp-public-ip-address/)

EIC Endpoint provides a secure solution to connect to your instances via SSH or RDP in private subnets without IGWs, public IPs, agents, and bastion hosts. By configuring an EIC Endpoint for your VPC, you can securely connect using your existing client tools or the Console/AWS CLI.

![EIC Endpoint](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1yhxct3pyxzvzg23gfve.png)
> Connect to private EC2 instances through an EIC Endpoint - Image Copyright AWS

In this post i am going to show you how you can create an EIC Endpoint and connect to an instance in a Private subnet, by using the AWS console and AWS CLI.


## Create the EC2 Instance Connect (EIC) Endpoint
Login to the AWS Console and Click on VPC. Then at the menu on the left, click **Endpoints** and then on **Create Endpoint**

![Create EIC Endpoint](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wc5g1l0m7ub5ohegmi1x.png)
In the next screen select the **_Instance Connect Endpoint_** option, your **_VPC_**, **_Security Group_** and **_Subnet_**.

![Create EIC Endpoint 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rn8vkd3gzdo0gq0jfz8q.png)![Create EIC Endpoint 11](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j79q6mka3pygh0nei6i4.png)
When done click on **Create Endpoint**

![Create EIC Endpoint 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/luc2qc6l43b4i9s3nziq.png)

Wait a few minutes, then hit refresh on the next screen. Your Endpoint should be now shown as **Available**.
![Create EIC Endpoint 3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8n5wvon292v7aonp6fb1.png)

If you prefer to create it using the AWS CLI, run the following command and replace _SUBNET_ and _SG-ID_.

```
aws ec2 create-instance-connect-endpoint \
    --subnet-id [_SUBNET_] \
    --security-group-id [_SG-ID_]
```

## Connect to your instance through AWS Console
_For the purpose of this tutorial, i have created an EC2 instance in a Private Subnet_

Click on **Connect**
![ec2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/38vrbexcktyqhzf44ief.png)
Select **Connect using EC2 Instance Connect Endpoint** and then pick your **Endpoint** from the list. Next click Connect

![ec2 connect](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ko5m9m2y802pfskec80h.png)
You have now successfully connected to your instance
![ec2 endpoing connection](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y6qz1zuxk9f1fc4i6uk2.png)

## Connect using the AWS CLI

This option requires some extra steps. At first you need to attach a policy to your user. You can use an AWS Managed one, to start and test the service.
![EIC endpoint policy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lre7gm3zd72i2iscy1iz.png)
But for best practises and security you can refer to this [link](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.html#iam-OpenTunnel) about how to create a custom policy.
Once done you can proceed.

To connect to your instance from the AWS CLI, you can run the following command where [_INSTANCE_] is the instance ID of your EC2 instance:

```
aws ec2-instance-connect ssh --instance-id [INSTANCE]
```
> The new _**EC2 Instance Connect Endpoint**_ feature has been added to AWS CLI v2.12.0.  If you are having issues, you just need to update your AWS CLI to the latest version.


![EIC Connect](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5syze72bq9nhs0tbx3ak.png)
![EIC Ebdpoint connect](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vvfq18swfc82rbxc89or.png)

## Conclusion
**EC2 Instance Connect Endpoint** offers several significant benefits to remote access management. As we can see, it eliminates the need to manage SSH key pairs manually, reducing the chances of key exposure or unauthorised access. Additionally, it allows you to grant temporary access to users by specifying the duration of their access, adding an extra layer of security. With EC2 Instance Connect Endpoint, you can also audit and track all remote access requests for compliance and governance purposes in CloudTrail.

You can read more about this great feature at this AWS post:[Secure Connectivity from Public to Private: Introducing EC2 Instance Connect Endpoint](https://aws.amazon.com/blogs/compute/secure-connectivity-from-public-to-private-introducing-ec2-instance-connect-endpoint-june-13-2023/)