Stop Whitelisting Port 22: SSH into Private EC2 from GitHub Actions via AWS SSM 🔐

GitHub Actions jobs often need to transfer build artifacts to EC2 instances for further processing. Traditionally, this involves generating an SSH key pair, storing the private key as a secret and the public key in the instance's authorized_keys file. This approach has several drawbacks: the key never rotates, anyone who can access the secret can access the production instance, and the port 22 must be opened to allow inbound connections.

A more secure solution is provided by AWS Systems Manager Session Manager (SSM). Session Manager allows SSH into EC2 instances without the need to open port 22 or manage keys. The SSM Agent running on the instance establishes an outbound HTTPS connection to AWS, creating a secure session that can be used to open a direct, encrypted tunnel for SSH. This approach eliminates the need for inbound security group rules, public IPs, bastion hosts, and key rotation.

The provided GitHub Action, ankurk91/setup-ssh-over-ssm-action, simplifies the process of setting up SSH via SSM. It automatically generates a short-lived SSH key, pushes it to the instance using EC2 Instance Connect, configures SSH to use SSM for the session, and cleans up after itself. All that's required is the instance ID, the user to log in as, and the AWS credentials with the necessary permissions.

The action handles generating and managing the SSH key, so there's no need to maintain any secrets or keys in your workflow.