老范的自言自语 Walter's Solo

How AWS SSM Agent Works for Credential Management

January 7, 2025 by walter

The AWS Systems Manager (SSM) Agent is a lightweight software component installed on your instances (e.g., EC2, on-premises servers, or VMs). It facilitates secure communication between your instance and the AWS Systems Manager service.

A key feature of the SSM Agent is the ability to retrieve and update credentials dynamically to interact with AWS services securely.

How AWS SSM Agent Works for Credential Management

1. Credential Retrieval

AWS SSM Agent retrieves credentials via the Instance Metadata Service (IMDS) or other methods depending on the instance's environment.

• AWS Instances (e.g., EC2):

  • The SSM Agent interacts with Instance Metadata Service Version 2 (IMDSv2) to fetch temporary credentials for the instance’s IAM Role.
  • The credentials are short-lived and include:
  • Access Key
  • Secret Key
  • Session Token
  • Example: The SSM Agent makes HTTP requests to the IMDS endpoint:

    
    curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
    "http://169.254.169.254/latest/api/token"

  curl -H "X-aws-ec2-metadata-token: " \
  "http://169.254.169.254/latest/meta-data/iam/security-credentials/"

• On-Premises or Non-AWS Environments:

  • Use AWS Systems Manager Hybrid Activation:
  • Register the instance as a managed node.
  • The managed instance uses an Activation Code and Activation ID to authenticate with Systems Manager and retrieve credentials.

2. Credential Updates

Temporary credentials retrieved by the SSM Agent are automatically refreshed:

• The expiration of temporary credentials is managed by AWS Security Token Service (STS).
• The SSM Agent automatically requests new credentials before the current ones expire (typically every hour).

3. Using Retrieved Credentials

After obtaining the credentials, the SSM Agent uses them to:

• Run commands:

  • Execute AWS Systems Manager Command documents (SSM Documents).
  • Example: aws s3 ls using retrieved credentials.

• Access AWS services:

  • The agent can upload logs, fetch scripts, or store session data in S3 using the instance role permissions.

• Session Manager:

  • Establish secure, browser-based or CLI-based shell access.
  • The SSM Agent uses the credentials to authenticate and open a WebSocket-based connection with the AWS Session Manager.

Flow Diagram: Credential Retrieval & Use

[ SSM Agent ] -> [ IMDS (EC2) or Activation Credentials (On-Premises) ] -> [ Temporary Credentials ]
       |
       v
[ AWS Services (e.g., S3, DynamoDB, CloudWatch) ]

Credential Rotation Process

1. Expiration Detection:

   • The SSM Agent detects the expiration time of the temporary credentials.

2. Automatic Refresh:

   • Before expiration, the agent queries IMDS or requests new credentials from the Systems Manager service.
   • The refresh ensures uninterrupted access to AWS services.

3. Seamless Usage:

   • The refreshed credentials are seamlessly used by the agent to execute its tasks.

Security Best Practices

1. Use Instance Profiles (EC2 Instances):

   • Attach least-privilege IAM roles to EC2 instances.
   • Example:

     {
     "Version": "2012-10-17",
     "Statement": [
      {
        "Effect": "Allow",
        "Action": "ssm:*",
        "Resource": "arn:aws:ssm:region:account-id:managed-instance/instance-id"
      }
     ]
     }

2. Enable IMDSv2:

   • Ensure that instances use IMDSv2, which is more secure than IMDSv1.
   • Disable IMDSv1 to reduce risks of credential leakage:

     aws ec2 modify-instance-metadata-options --instance-id  \
      --http-tokens required --http-endpoint enabled

3. Hybrid Activations for On-Premises Nodes:

   • Use activation codes and secure configurations for non-AWS environments.

4. Session Logging:

   • Enable Session Manager Logging to CloudWatch or S3 for monitoring.

5. Instance Isolation:

   • Limit the IAM role permissions and network access to reduce attack surface.

Comparison of AWS SSM and IAM Roles Anywhere

AWS SSM Agent is a managed and automated solution for EC2 or registered nodes, making it an ideal choice for AWS-centric environments.

Comments |0|