AWS AWSEC2 documentation change
Summary
Updated documentation to include IPv6 support details, clarify EC2 Instance Connect Endpoint state requirements, and provide enhanced CLI instructions for connecting via instance ID/IPv6
Security assessment
The changes add documentation about IPv6 compatibility requirements and endpoint IP address type validation, which helps prevent misconfigurations that could lead to connection failures or unintended exposure. However, there is no explicit mention of addressing a specific security vulnerability.
Diff
diff --git a/AWSEC2/latest/UserGuide/connect-using-eice.md b/AWSEC2/latest/UserGuide/connect-using-eice.md index 74ce0bece..8b881c0fe 100644 --- a//AWSEC2/latest/UserGuide/connect-using-eice.md +++ b//AWSEC2/latest/UserGuide/connect-using-eice.md @@ -5 +5 @@ -(Linux) Connect using the console(Linux) Connect using SSH(Linux) Connect using the AWS CLI(Windows) Connect using RDPTroubleshoot +(Linux) Connect using the console(Linux) Connect using SSH(Linux) Connect with the instance ID using the AWS CLI(Windows) Connect using RDPTroubleshoot @@ -15 +15 @@ You can use EC2 Instance Connect Endpoint to connect to an Amazon EC2 instance t - * The EC2 Instance Connect Endpoint must be in the **Available** (console) or `create-complete` (AWS CLI) state. If you do not have an EC2 Instance Connect Endpoint for your VPC, you can create one. For more information, see [Create an EC2 Instance Connect Endpoint](./create-ec2-instance-connect-endpoints.html). + * The EC2 Instance Connect Endpoint must be in one of the following states: @@ -17 +17,7 @@ You can use EC2 Instance Connect Endpoint to connect to an Amazon EC2 instance t - * Your instance must have an IPv4 address (either private or public). EC2 Instance Connect Endpoint does not support connecting to instances using IPv6 addresses. + * **create-complete** for a new endpoint + + * **update-in-progress** , **update-complete** , or **update-failed** for an existing endpoint being modified. When modifying an endpoint, it continues using its original configuration until the status changes to **update-complete**. + +If your VPC doesn't have an EC2 Instance Connect Endpoint, you can create one. For more information, see [Create an EC2 Instance Connect Endpoint](./create-ec2-instance-connect-endpoints.html). + + * The EC2 Instance Connect Endpoint IP address type must be compatible with the IP address type of the instance. If your endpoint IP address type is dual-stack, then it can work for both IPv4 and IPv6 addresses. @@ -32 +38 @@ You can use EC2 Instance Connect Endpoint to connect to an Amazon EC2 instance t - * Connect to your Linux instance using the AWS CLI + * Connect to your Linux instance with its instance ID using the AWS CLI @@ -55 +61,3 @@ You can connect to an instance using the Amazon EC2 console (a browser-based cli - 5. Choose **Connect using a Private IP**. + 5. For **Connection type** , choose **Connect using a Private IP**. + + 6. Choose either **Private IPv4 address** or **IPv6 address**. The options are available based on the IP addresses assigned to your instance. If an option is greyed out, your instance does not have an IP address of that type assigned to it. @@ -57 +65 @@ You can connect to an instance using the Amazon EC2 console (a browser-based cli - 6. For **EC2 Instance Connect Endpoint** , choose the ID of the EC2 Instance Connect Endpoint. + 7. For **EC2 Instance Connect Endpoint** , choose the ID of the EC2 Instance Connect Endpoint. @@ -59 +67 @@ You can connect to an instance using the Amazon EC2 console (a browser-based cli - 7. For **Username** , if the AMI that you used to launch the instance uses a username other than `ec2-user`, enter the correct username. +###### Note @@ -61 +69,5 @@ You can connect to an instance using the Amazon EC2 console (a browser-based cli - 8. For **Max tunnel duration (seconds)** , enter the maximum allowed duration for the SSH connection. +The EC2 Instance Connect Endpoint must be compatible with the IP address you chose in the previous step. If your endpoint IP address type is dual-stack, then it can work for both IPv4 and IPv6 addresses. For more information, see [Create an EC2 Instance Connect Endpoint](./create-ec2-instance-connect-endpoints.html). + + 8. For **Username** , if the AMI that you used to launch the instance uses a username other than `ec2-user`, enter the correct username. + + 9. For **Max tunnel duration (seconds)** , enter the maximum allowed duration for the SSH connection. @@ -65 +77 @@ The duration must comply with any `maxTunnelDuration` condition specified in the - 9. Choose **Connect**. This opens a terminal window for your instance. + 10. Choose **Connect**. This opens a terminal window for your instance. @@ -72 +84 @@ The duration must comply with any `maxTunnelDuration` condition specified in the -You can use SSH to connect to your Linux instance, and use the `open-tunnel` command to establish a private tunnel. You can use `open-tunnel` in single connection or multi-connection mode. +You can use SSH to connect to your Linux instance, and use the `open-tunnel` command to establish a private tunnel. You can use `open-tunnel` in single connection or multi-connection mode. You can specify your instance ID, a private IPv4 address, or an IPv6 address. @@ -92 +104 @@ For: - * ``ec2-user`@`i-1234567890abcdef0`` – Specify the username of the AMI that was used to launch the instance, and the instance ID. + * ``ec2-user`@`i-1234567890abcdef0`` – Specify the username of the AMI that was used to launch the instance, and the instance ID. For instances with an IPv6 address, you must specify the IPv6 address instead of the instance ID. @@ -94 +106 @@ For: - * `--instance-id` – Specify the ID of the instance to connect to. Alternatively, specify `%h`, which extracts the instance ID from the user. + * `--instance-id` – Specify the ID of the instance to connect to. Alternatively, specify `%h`, which extracts the instance ID from the user. For instances with an IPv6 address, replace `--instance-id `i-1234567890abcdef0`` with `--private-ip-address `2001:db8::1234:5678:1.2.3.4``. @@ -111 +123 @@ To allow multiple connections to an instance, first run the [open-tunnel](https: -Expected output +Expected output: @@ -130 +142 @@ You might also see the following: -## Connect to your Linux instance using the AWS CLI +## Connect to your Linux instance with its instance ID using the AWS CLI @@ -136 +148,6 @@ If you only know your instance ID, you can use the [ec2-instance-connect ssh](ht -Install AWS CLI version 2 and configure it using your credentials. For more information, see [Install or update to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [Configure the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) in the _AWS Command Line Interface User Guide_. Alternatively, open AWS CloudShell and run AWS CLI commands in its pre-authenticated shell. + * Install AWS CLI version 2 and configure it using your credentials. For more information, see [Install or update to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [Configure the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) in the _AWS Command Line Interface User Guide_. + + * Alternatively, open AWS CloudShell and run AWS CLI commands in its pre-authenticated shell. + + + @@ -140 +157,17 @@ Install AWS CLI version 2 and configure it using your credentials. For more info -If you only know the instance ID, use the [ec2-instance-connect ssh](https://docs.aws.amazon.com/cli/latest/reference/ec2-instance-connect/ssh.html) CLI command, and specify the `ssh` command, the instance ID, and the `--connection-type` parameter with the `eice` value. +If you only know the instance ID, use the [ec2-instance-connect ssh](https://docs.aws.amazon.com/cli/latest/reference/ec2-instance-connect/ssh.html) CLI command, and specify the `ssh` command, the instance ID, and the `--connection-type` parameter with the `eice` value to use an EC2 Instance Connect Endpoint. If the instance only has an IPv6 address, you must also include the `--instance-ip` parameter with the IPv6 address. + + * If the instance has a private IPv4 address (it can also have an IPv6 address) use the following command and parameters: + + aws ec2-instance-connect ssh \ + --instance-id i-1234567890example \ + --os-user ec2-user \ + --connection-type eice + + * If the instance only has an IPv6 address, include the `--instance-ip` parameter with the IPv6 address: + + aws ec2-instance-connect ssh \ + --instance-id i-1234567890example \ + --instance-ip 2001:db8::1234:5678:1.2.3.4 \ + --os-user ec2-user \ + --connection-type eice + @@ -143 +175,0 @@ If you only know the instance ID, use the [ec2-instance-connect ssh](https://doc - aws ec2-instance-connect ssh --instance-id i-1234567890example --os-user ec2-user --connection-type eice @@ -147 +179 @@ If you only know the instance ID, use the [ec2-instance-connect ssh](https://doc -If you get an error when using this command, make sure that you're using AWS CLI version 2. The `ssh` parameter is only available in AWS CLI version 2. For more information, see [About AWS CLI version 2](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html#welcome-versions-v2) in the _AWS Command Line Interface User Guide_. +If you get an error, make sure that you're using AWS CLI version 2. The `ssh` parameter is only available in AWS CLI version 2. For more information, see [About AWS CLI version 2](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html#welcome-versions-v2) in the _AWS Command Line Interface User Guide_.