- Newest
- Most votes
- Most comments
Hello.
Setting SCP guardrails in AWS Control Tower will not prevent you from using SSH.
Depending on the contents of the SCP, connections from the management console (Session Manager, EC2 Instance Connect), etc. may not be available, but SSH from a terminal such as Linux or Mac is not restricted.
What error are you getting when doing SSH from your local PC?
If it is a timeout error, I think you need to check the security group, network ACL, and route table settings of the subnet where EC2 is running.
Is a route destined for the Internet gateway added to the subnet's route table?
https://repost.aws/knowledge-center/ec2-linux-ssh-troubleshooting
- NAT gateway attached to both private and public subnets.
There is no need to add a route to the NAT Gateway in the public subnet's route table.
- Security groups, I've tried inbound http:80, https:443, ssh:20, and even tried the all:anywhere.
The default port for SSH is port 22.
Relevant content
- asked 3 months ago
AWS OFFICIALUpdated 3 years ago- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated a year ago
Hi thank you for answering, so I tried something else after which was to try using a different computer I had access to. Seeing as 2 of them didn't seem to be able to connect to it, but on this 3rd computer tried connecting via SSH and I was able to get through successfully but although I can connect via ssh now, the main issue I had is still related to browser access. I was testing my ec2 instances to see if outside access could get a response from ec2 as I was trying to setup a host zone and dns to a outside domain I had. The route tables show the subnet which the ec2 is on have connection to the internet gateway. I tried changing the ACL inbound rule to just http:80, but that didn't work either. I tried pinging a specific ip and it does have access to internet as I get a response back, therefore I'm a little confused what's the hiccup here.
In the network ACL, allow number 80 in the inbound rule and allow all traffic in the outbound rule. Please allow number 80 in the inbound rule in the security group. Also, check if a web server such as Apache or Nginx is running on EC2.
Thank you so much, I was not expecting it to be because I didn't have a server installed. But this brings up the question as the 1 of the 3 accounts I tested on didn't have apache installed, I used a simple user data which enabled the the httpd and it worked fine with a blank page or html text I included and public ip was accessible via browser. So why was it that I had to manually install the the apache server before I could manually access the ip address to get some response from the ec2 on the other 2 accounts even though I replicated the setup method on all 3?
Maybe the user data didn't work for some reason. We recommend that you check the user data execution log etc. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html
Oh thank you, I'm still very new to this so the AWS ssh/cli terminal commands are still foreign to me. After doing as you suggested for the log, my script did indeed not run as it didn't show any server installation. Good to know for testing purposes I should manually do the installs rather than try to use a script that worked before and alter it.