SSM Agent to automate CLI

Question

After connecting to a VPC instance via a private user declared with the built-in CLI ( script-shell.sh ). I need to enter commands to perform tasks. The problem is that after the connection, the linux command lines embedded in the (AWS CLI) are not executed, below is the code:

script_shell.sh
```
#!/bin/bash

# Etapa 1
# Configuração das credenciais da AWS e estabelecimento da conexão
echo "Estabelecendo conexão com a conta ( AWS ) . . ."
export AWS_ACCESS_KEY_ID="xxxxxxxxxxx"
export AWS_SECRET_ACCESS_KEY="xxxxxxxxxxx"
sleep 3
echo "Conexão estabelecida a conta ( AWS )."

# Etapa 2
# Listar as instancias ec2 e definir qual delas acessar
json=$(aws ec2 describe-instances --region us-east-1)
# Extrai o valor da chave InstanceId usando o jq
instance_id=$(echo "$json" | jq -r '.Reservations[0].Instances[0].InstanceId')

# Connect to an instance using the instance ID and an EC2 Instance Connect Endpoint
aws ec2-instance-connect ssh --instance-id $instance_id --connection-type eice --region us-east-1

# From here on down do the commands stop being executed in the terminal ?
# Wait for the connection to be established. . .
aws ec2 wait instance-ssh-connection-established --instance-id $instance_id --region us-east-1
# Start the session and sends linux commands. . .
aws ssm start-session --target $instance_id --document-name "AWS-StartInteractiveCommand" --parameters "commandLine=['sudo su -c \"cd /; ls\"']" --region us-east-1
```

0v0 ( How can I make linux commands run on the instance ? )

Answer

Hi John,

Here are the steps you need to follow:

a. Create a EC2 service role with **AmazonSSMFullAccess*

b. Attach this role to ec2, go to **Actions** -> **Security** -> **Modify IAM Role**

c. Make sure, security group attached to EC2 instance, allow inbound traffic from your machine(for testing purpose you can allow All traffic, anywhere -not recommended though, and remove after testing)

d. After installing the SSM agent on ec2, follow these steps:

1. aws ec2-instance-connect send-ssh-public-key --instance-id $instance_id --instance-os-user ec2-user --availability-zone us-east-1d --ssh-public-key file:///Users/abc/.ssh/id_rsa.pub --region us-east-1 --profile 
2. aws ssm send-command --instance-ids $instance_id --document-name "AWS-RunShellScript" --parameters '{"commands":["sudo su"]}' --region us-east-1 --profile  --output text
3. aws ssm send-command --instance-ids $instance_id --document-name "AWS-RunShellScript" --parameters '{"commands":["cd /"]}' --region us-east-1 --profile  --output text
4. aws ssm send-command --instance-ids $instance_id --document-name "AWS-RunShellScript" --parameters '{"commands":["ls"]}' --region us-east-1 --profile  --output text

Make sure, in step-1, you pass your local machine ssh public key, from where you intend to connect to ec2 instance.

I'm attaching snapshot for your reference:

![Enter image description here](/media/postImages/original/IMK_KgMxLFStSh_pritC7GBg)

Here is the script version of same attempt:

**1. Script content and it's output:**

![Enter image description here](/media/postImages/original/IM4TfcWMHWT5CFq-fZH83xNg)

**2. File which is present at root directory on EC2 instance and I'm doing 'cat' through SSM as mentioned above in the script content:**

![Enter image description here](/media/postImages/original/IMSzFmGnxlSZWTuuvFi642Tw)

**3. Finally the command output from SSM console to verify it's working as expected:**

![Enter image description here](/media/postImages/original/IMG1q0bJXlQDqzCTI4ha0Ndw)

Hope you find this helpful, let me know how it works for you.

SSM Agent to automate CLI

Relevant content