# EB SSM

This simple script helps you SSH into an Elastic Beanstalk server using AWS SSM.

While `eb ssh` exists, it requires each individual user to have the EC2 instance private keys locally. This is unideal
from both an information security and access management standpoint. If you've configured SSM, users will no longer need
the EC2 instance private keys to SSH into Elastic Beanstalk instances and instead have their access managed via IAM.

eb-ssm is desinged to combine tools from the EB CLI and the AWS CLI to provide a better alternaitve to `eb ssh`.

## Prerequisites

### Set up your Elastic Beanstalk Environment to allow SSH via AWS SSM

The following steps need to be done once per environment.

1. Go to Elastic Beanstalk > ENVIRONEMNT_NAME > Configuration > Security and find the "IAM instance profile" (by default, this is "aws-elasticbeanstalk-ec2-role").  This is ROLE_NAME in step 2.

2. Go to IAM > Roles > ROLE_NAME.  Under permissions, add "AmazonSSMManagedInstanceCore".

3. Go to Systems Manager > Session Manager > Preferences > Edit.  Enable "Run As Support" and set the "Run As Defualt User" to be "ec2-user" (or whatever the default user for your Elastic Beanstalk servers is).

### Configure your local computer

The following steps need to be done once per computer.

1. Install the AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html

2. Install the Session Manager Plugin: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html

## Using EB SSM

Install eb-ssm via `pip install eb-ssm`.

Once it is installed, all you need to do is run `eb-ssm` from your repository and it will automatically hook into your repository's EB configuration (in .elasticbeanstalk/config.yml).

To ssh into a specific environment, use `eb-ssm ENVIRONMENT_NAME`.

You can also optionally pass other parameters, such as an AWS CLI profile or a region to eb-ssm.  See `eb-ssm --help` for a full list of options.

## Config

eb-ssm uses the EB CLI configuration files.  If you have not used the EB CLI to set up a project, here is the minimal configruation needed by eb-ssm; this configraution lives in `.elasticbeanstalk/config.yml`:

```
global:
  application_name: EB_APPLICATION_NAME
  default_region: REGION_NAME
  profile: PROFILE_NAME
```
