amazon-web-servicesamazon-ec2amazon-elastic-beanstalkaws-visual-studio-toolkit

Elastic Beanstalk & EC2 Instance Connect: Can't connect

I created an Elastic Beanstalk environment from Visual Studio and need to login to service the underlying ec2 vm.

I don't have an credentials for the server, so I wanted to use EC2 Instance Connect.

When I click connect, I get an error message:

We were unable to connect to your instance. Make sure that your instance’s network settings are configured correctly for EC2 Instance Connect. For more information, see Task 1: Configure network access to an instance.

Following the link, I found the instructions:

  • Ensure that the security group associated with your instance allows inbound SSH traffic on port 22 from your IP address or from your network.
  • (Amazon EC2 console browser-based client) We recommend that your instance allows inbound SSH traffic from the recommended IP block published for the service. Use the EC2_INSTANCE_CONNECT filter for the service parameter to get the IP address ranges in the EC2 Instance Connect subset.

How do I connect to the Elastic Beanstalk underlying EC2 via EC2 Instance Connect?

What I've tried:

I created a new security group that contains my client IP address, but that didn't work. Which makes sense, as it's the EC2 Instance Connect app running in the Console making the SSH connection, not my local machine.

Also looked at the the ip ranges json file (https://ip-ranges.amazonaws.com/ip-ranges.json), but not sure what to do with that.

enter image description here

Solution

  • I misunderstood the Set up EC2 Instance Connect instructions. This support article had clearer instructions: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-connect-troubleshooting/

    Browser-based SSH connections require that your instance's security group inbound rules allow EC2 Instance Connect access to SSH on TCP port 22.

    The key was to find the IP for EC2 Instance Connect and then create a security group to whitelist that ip address.

    EC2 Instance Connect IP can be retrieved via PowerShell by using Get-AWSPublicIpAddressRange (or curl). For us-west-2:

    > Get-AWSPublicIpAddressRange -Region us-west-2 -ServiceKey EC2_INSTANCE_CONNECT | select IpPrefix


IpPrefix
--------
18.237.140.160/29

    Once I configured my Security Group to use that Source I could connect.

    enter image description here