No more Bastion Host (EC2 Instance Connect Endpoint Service)

A revolutionary new tool that streamlines and improves your instance management experience has been unveiled by Amazon Web Services (AWS) -EC2 Instance Connect Endpoint. You no longer require an IGW in your VPC, a public IP address on your resources, or the more established key-based connections to securely access your Amazon EC2 instances.
EC2 Instance Connect Endpoint is a useful utility that enables you to create safe connections with your Amazon EC2 instances without having to worry about maintaining and sharing SSH keys. You can quickly connect to your instances and resolve problems with just a few easy steps while maintaining a high-security level.

Your private EC2 instances within Amazon VPCs can be connected securely and conveniently with the help of the EC2 Instance Connect Endpoint. It does away with the demand for extra parts, such as bastion hosts and complicated network settings. EC2 Instance Connect Endpoint guarantees secure remote access to your private resources by utilizing IAM-based authentication, network boundary controls, and auditability. An easy and secure connecting option is offered in your AWS environment by implementing EC2 Instance Connect Endpoint. To get started with EC2 Instance Connect Endpoint, you need to follow these steps:

1. SSH Connection: Establishing a connection to Linux instances using SSH: You can connect to Linux instances via the AWS CLI. Two techniques are accessible:

2. Creating an EIC Endpoint: You can construct an EC2 Instance Connect Endpoint using the AWS CLI or Console if you are an administrator with the required IAM rights. The IDs for the subnet and security group must be provided.

3. _ Open-tunnel command_: You can also use SSH with regular tooling or the proxy command to create a private tunnel to the instance. This solution provides flexibility for existing workflows and necessitates the use of the AWS CLI.

4. One-click command: Ephemeral SSH keys may be generated with only one click using the AWS CLI, which also offers a command to connect with higher security. Utilizing this command requires the proper IAM permissions.

5. Windows RDP connection: RDP (Remote Desktop Protocol) can be used to safely access Windows instances within your Amazon VPC if you have any. RDP client software guarantees a quick and secure connection to a Windows instance.

LIMITATIONS

1. IPv6 addresses are not supported for connecting to instances through the EC2 Instance Connect Endpoint.

2. The instance to connect to must be in the same VPC as the EC2 Instance Connect Endpoint if client IP preservation is enabled.

3. In situations where traffic is sent over an AWS Transit Gateway, client IP preservation is not supported.

4. Client IP retention is not supported for the following instance types: C1, CC1, CC2, CG1, CG2, CR1, G1, G2, HI1, HS1, M1, M2, M3, and T1.

Reference Links:

• https://aws.amazon.com/about-aws/whats-new/2023/06/amazon-ec2-instance-connect-ssh-rdp-public-ip-address/
• https://aws.amazon.com/about-aws/whats-new/2023/06/amazon-ec2-instance-connect-ssh-rdp-public-ip-address/
• https://dev.to/prosperagada/understanding-aws-instant-connect-end-point-30g5
• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html
• https://medium.com/@2017tejasgupta/connect-to-your-instances-with-a-private-ipv4-address-using-ec2-instance-connect-endpoint-c92ad3efc545