I followed this guide (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.html). I can connect to the instance using the console but can't connect using AWS CLI. This is the output I get.
aws ec2-instance-connect ssh --instance-id i-0daa56a4c6ce5578d
usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]
To see help text, you can run:
aws help
aws <command> help
aws <command> <subcommand> help
aws: error: argument operation: Invalid choice, valid choices are:
send-ssh-public-key | send-serial-console-ssh-public-key
help
When I use the valid choices provided above, this is what I get
aws ec2-instance-connect send-ssh-public-key --instance-id i-0daa56a4c6ce5578d --availability-zone us-east-1a --instance-os-user ec2-user --ssh-public-key file://my_key.pub
{
"RequestId": "fa460a07-0df4-4886-bcc0-7eaf808f3cf6",
"Success": true
}
Where should I go from here?
Here my ec2 instance have only private IP address. So using ec2 instance connect endpoint method. AWS CLI with latest version is already in place. Forgot to mentioned one point, the connection to ec2 instance from user's AWS management console is working fine. But when trying from AWS CLI getting the error.
I tried with command AWS CLI command
ssh -i EC2-test-eu-west.pem ubuntu@i-017dea0ab67a46427 -o ProxyCommand='aws ec2-instance-connect open-tunnel --instance-id i-017dea0ab67a46427 --max-tunnel-duration 3600'
It worked.
But when trying with ssh command only with instance ID
aws ec2-instance-connect ssh --instance-id i-017dea0ab67a46427 --connection-type eice
2024-09-04 04:52:22,417 - awscli.customizations.ec2instanceconnect.websocket - ERROR - {"ErrorCode":"AccessDeniedException","Message":"User: arn:aws:iam::331583424502:user/Sushant is not authorized to perform: ec2-instance-connect:OpenTunnel on resource: arn:aws:ec2:eu-west-1:331583424502:instance-connect-endpoint/eice-0b1154d46b6707316 because no identity-based policy allows the ec2-instance-connect:OpenTunnel action"}
AWS_ERROR_HTTP_WEBSOCKET_UPGRADE_FAILURE: Failed to upgrade HTTP connection to Websocket.
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535