Restrict AWS SSM connection to ec2 instance from OpenVPN server

Hi Siva,

Thank you for reaching out! Let's dive into your scenario and work toward a clear, actionable solution. 😊

---

Clarifying the Issue

The goal is to access an EC2 instance using AWS SSM, but only when connected through an OpenVPN server. Currently, traffic to AWS SSM is not routing correctly through the OpenVPN server due to split tunneling. Additionally, the EC2 instance resides in a separate, isolated VPC, and you've implemented restrictive IAM policies to limit access. You’re also considering whether modifications to the OpenVPN server configuration can address the routing issue effectively.

---

Key Terms

• AWS SSM (Systems Manager): A service that allows secure instance management without requiring direct SSH access.
• OpenVPN: A VPN solution that provides secure point-to-point connections.
• VPN (Virtual Private Network): A private network that encrypts and securely routes traffic over the internet, often used to connect remote users or devices to a private network.
• VPC (Virtual Private Cloud): A logically isolated section of AWS where you can launch and manage AWS resources securely in a virtual network.
• VPC Endpoint: Enables private connections to AWS services from within a VPC.
• Split Tunneling: A VPN configuration where only specific traffic is routed through the VPN, while other traffic bypasses it and goes directly to the internet. This is useful for reducing VPN bandwidth usage but can lead to routing issues if not configured correctly.

---

The Solution (Our Recipe)

Steps at a Glance:

1. Update the OpenVPN server configuration to push AWS SSM endpoint routes.
2. Test the DNS resolution for VPC endpoints from the OpenVPN server.
3. Verify IAM policy effectiveness and ensure proper IP-based restrictions.
4. Validate routing and connectivity between OpenVPN and EC2 via SSM.

---

Step-by-Step Guide:

1. Update the OpenVPN server configuration to push AWS SSM endpoint routes:

   • Modify the OpenVPN server's server.conf to include the necessary routes for AWS SSM. For example:

     push "route ssm.us-east-1.amazonaws.com 255.255.255.255"
     push "route ssmmessages.us-east-1.amazonaws.com 255.255.255.255"
     push "route ec2messages.us-east-1.amazonaws.com 255.255.255.255"
     

     Alternatively, if using VPC endpoints, push the private endpoint routes:

     push "route vpce-id.ec2messages.region.vpce.amazonaws.com 255.255.255.255"
     

   • Restart the OpenVPN service to apply changes:

     sudo systemctl restart openvpn
     

---

2. Test the DNS resolution for VPC endpoints from the OpenVPN server:

   • Verify that your OpenVPN server can resolve private DNS names for the VPC endpoints. Use the following command:

     nslookup ssmmessages.region.amazonaws.com
     

   • Ensure the DNS resolver points to the VPC’s DNS server (e.g., 10.x.0.2).

3. Verify IAM policy effectiveness and ensure proper IP-based restrictions:

   • Confirm that the policy applied to your IAM user or group includes the following conditions:

     "Condition": {
         "NotIpAddress": {
             "aws:SourceIp": ["VPN_IP_1/32"]
         }
     }

   • Test the policy using AWS CLI:

     aws ssm start-session --target <instance-id>
     

     The session should succeed only when connected through the VPN.

---

4. Validate routing and connectivity between OpenVPN and EC2 via SSM:

   • Ensure the OpenVPN private IP range (e.g., 10.x.1.0/24) is allowed in the EC2 security group.

   • Test SSM connectivity using the following command:

     aws ssm start-session --target <instance-id>
     

   • Verify traffic routes through the OpenVPN tunnel by checking the traceroute output:

     traceroute ssm.us-east-1.amazonaws.com
     

---

Closing Thoughts

With these steps, you can ensure secure and reliable SSM access to your EC2 instance via OpenVPN. By leveraging VPC endpoints, restrictive IAM policies, and proper routing configurations, you maintain strong security while enabling the required access. Let us know how it goes, and feel free to reach out for further guidance! 🌟

---

Good luck, Siva! You're doing great in creating a secure and well-structured setup. Keep up the fantastic work! 🚀✨

---

Cheers, Aaron 😊