有没有办法使用IAM来管理开发人员对EC2实例的访问？ （ssh不是ec2 api）

Question

Is there a way to use IAM to manage developer access to an EC2 instance? (ssh not ec2 API).

Not the EC2 rest API or the online console but to manage individual ssh or ftp access to a server?

Answer 1

What you are looking for is a linux Pluggable Authentication Module (PAM) that talks to the AWS IAM service.

This is not available out of the box in an image, but have a look here: https://github.com/denismo/aws-iam-ldap-bridge

This project allows you to sync an LDAP server with IAM, and then you can configure your sshd to use the LDAP server.

That might work for you.

Answer 2

You can use either of these two projects: https://github.com/widdix/aws-ec2-ssh or https://github.com/kislyuk/keymaker

They amount to synchronising the IAM accounts to the user accounts and can pull the SSH keys in. They both rely on a cron job to keep them up to date.

Answer 3

No, IAM is meant to control access to EC2 resources. Logging into an instance via SSH cannot be qualified as same. Anyone who has .pem key and can log into the instance (presuming the ssh access is allowed in security groups).