Connecting to EC2 Instances using Azure AD Users
Tags: aws, azuread, ec2, documentation
Published: 2022-12-17 07:01:27

## Introduction

We will connect EC2 Instances using Session Manager. These steps are only for testing/evaluation purposes. Please use the least privileged permissions/roles.

## Prerequisite

### Configured Enterprise Application & Assigned Related IAM Role to Azure AD Users

Please refer to the main [README.md](https://github.com/bervProject/AzureADxAWSIntegrator).

Note:
* [Required IAM Policies for Users](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.html)

### Setting EC2 Instances to support Session Manager

* Please refer to this [documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html) to set up Session Manager.

Note:
* [Supported OS](https://docs.aws.amazon.com/systems-manager/latest/userguide/prereqs-operating-systems.html).
* [Required IAM Profile for EC2 Instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-profile.html).
* [Setting up SSM Agent - if it's not installed by default](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html).
* If you have other cases, please refer to this [documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up.html) for setting up AWS Systems Manager.

### Supported Tools

* [AWS CLI](https://aws.amazon.com/cli/)
* [aws-azure-login](https://www.npmjs.com/package/aws-azure-login/v/1.0.0): Integrate AWS CLI with Azure AD SSO
* [Session Manager Plugin](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html
)

## Steps

### Configuration

1. `npm install -g aws-azure-login` -> Install `aws-azure-login`
2. `aws configure --profile <target profile>` -> Example: `aws configure --profile aad`, you only need to configure default region, if you want it.

    ![aws configure](https://user-images.githubusercontent.com/15927349/208228041-f2fec3f7-0cb9-4a10-b647-e30c5a7d817d.png)

3. `aws-azure-login --configure --profile <target-profile>` -> Example: `aws-azure-login --configure --profile aad`

    ![aws azure login](https://user-images.githubusercontent.com/15927349/208228067-5e636898-2194-4a32-ad39-d9264bb83f18.png)
    
    a. You only need to configure the tenant id, app id, and default session duration (recommend using 1 hour).

### Connect to EC2 Instances using existing profile

4. `aws-azure-login --profile <target profile>` -> Example `aws-azure-login --profile <target profile>`.

    ![azure login](https://user-images.githubusercontent.com/15927349/208228143-3b1cf855-7c80-4ac4-9f9d-797483619be1.png)

    note: I use the default username, so I input the password only.

5. `aws ssm --region <target region> --profile <target profile> start-session --target <ec2-instance-id>`. You don't need to set a region if your instance is the same as the default region.

    ![login](https://user-images.githubusercontent.com/15927349/208228208-4dc62585-987f-4449-a87b-6c9f95409b8a.png)

Note:
* More information to connect EC2 Instances using Session Manager: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html

## Key Resources

* [Session Manager Plugin](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html
)
* [SSM Prerequisites](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html)
* [Required IAM Policies for Users](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.html)
* [Required IAM Profile for EC2 Instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-profile.html)

---

[Source](https://github.com/bervProject/AzureADxAWSIntegrator/wiki/Connect-Azure-AD-Account-with-EC2-Instances)

## Thank you

![GIF Thanks](https://media.giphy.com/media/3oEdva9BUHPIs2SkGk/giphy.gif)