AWS Session Manager is not sourcing bash rc

user_1951414 0
Viewed 1535

I am using AWS Systems Manager Session Manager to connect to my EC2 instance.

When I connect, the session does not source my .bashrc or .bash_profile, so I get a pretty plain shell and would like to setup some configuration when it starts.

The session manager connects me as the ec2-user but the shell starts in the / directory and not the user directory.

I am unable to figure out if it is sourcing any configuration files when it starts up.
How can I get it to source the users configuration files?

I have set up session manager to use the ec2-user by enabling the "run as support" setting.

If I connect to an instance using the EC2 instance connect then it works as you can see here: EC2 instance connect with sourced files

However if I use the session manager, the configuration files are not sourced as you can see here:

enter image description here

amazon-web-services bash
3 Answers

AWS Systems Manager Session Manager uses an "agent" to establish a connection with the Amazon EC2 instance. The agent registers the instance with Systems Manager. When a connection is requested, a message is sent to the agent. Commands are then sent to the agent, which executes them locally and sends back the results.

Therefore, Session Manager is not actually logged into a bash session. It is simply executing the commands one-at-a-time as received.

The benefit of Session Manager is that it can be used to connect to a private EC2 instance because the agent establishes an 'outbound' connection to AWS, rather than the connection request being sent 'to' the instance.

Amazon EC2 Instance Connect, in contrast, actually establishes a normal SSH connection to the instance. The web browser uses a Guacamole connection to AWS, which then uses normal SSH (with an extra hack to permit temporary keypairs) to run the commands. Therefore, it looks like a normal connection running against the shell.

You can actually use the "temporary SSH keys" feature of EC2 Instance Connect together with a normal SSH client, without using the web-based SSH client. Thus, it's actually two features in one: a web-based SSH client, and a means of using temporary keypairs to establish the SSH connection.

user_1747770

This happens because by default you are logged as ssm-user, not ec2-user. Thus to log in as ec2-user you can execute the following command: 

sudo su - ec2-user

This will login you as ec2-user, source your .bashrc and place you in /home/ec2-user.

Alternatively, if you use EC2 Instance connect, ec2-user is specify as default and it correctly loads you into /home/ec2-user and sources your bash.

<code>/home/ec2-user</code>

enter image description here

user_2488230

As Session Manager is not actually logged into a bash session, but we can do that by creating a custom InteractiveCommands session document that will just switch to ssm-user bash. The steps are below.

  1. Create AWS SSM document "session" type named "SSM-LogLinuxBash" and paste the below content.
   {
      "schemaVersion": "1.0",
      "description": "Document to run single interactive command on an instance",
      "sessionType": "InteractiveCommands",
      "parameters": {
        "logpath": {
          "type": "String",
          "description": "Logged in as bash shell",
          "default": "",
          "allowedPattern": "^[a-zA-Z0-9-_/]+(.log)$"
        }
      },
      "properties": {
        "linux": {
          "commands": "su ssm-user",
          "runAsElevated": true
        }
      }
    }
  1. Create IAM policy that can access the above SSM document and ec2 instance.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SSM-LogLinuxBash-IAMPolicy",
            "Effect": "Allow",
            "Action": "ssm:StartSession",
            "Resource": [
                "arn:aws:ssm:*:*:document/SSM-LogLinuxBash",
                "arn:aws:ec2:*:*:instance/<instanceid>or*"
            ]
        },
        {
            "Sid": "TerminateSSM Session",
            "Effect": "Allow",
            "Action": "ssm:TerminateSession",
            "Resource": "arn:aws:ssm:*:*:session/${aws:username}-*"
        }
    ]
}
  1. Attach policy to IAM group or IAM user.
  2. Access the instance
aws ssm start-session --target <instance-id-here> --document-name SSM-LogLinuxBash

For details please go through the below blog. For complete implementation

user_38755970
Related