We still need bastion hosts to connect to RDS, but they're no longer accessible from the internet since we use SSM.
`ssh aws-bastion` invokes a ProxyCommand that:
1) finds an actual bastion host by tag using ec2 describe-instances
2) generates a short-lived ssh key and adds it to the ssh agent
3) sends the temporary key to the bastion using ec2-instance-connect send-ssh-public-key
4) starts the SSM/ssh session using AWS-StartSSHSession
Since it's SSH, we can port forward, use multiplexing, etc. We use Google as the IdP, via AWS SSO. Bastions periodically sync users from a Google group.
Yeah, SSM supports just opening a terminal on the remote host without ssh. We started with regular ssh bastions though so I just stuck with that. They're just no longer routeable from outside.
`ssh aws-bastion` invokes a ProxyCommand that:
1) finds an actual bastion host by tag using ec2 describe-instances
2) generates a short-lived ssh key and adds it to the ssh agent
3) sends the temporary key to the bastion using ec2-instance-connect send-ssh-public-key
4) starts the SSM/ssh session using AWS-StartSSHSession
Since it's SSH, we can port forward, use multiplexing, etc. We use Google as the IdP, via AWS SSO. Bastions periodically sync users from a Google group.