DevOps Community Sponsored by Cloud Posse

SweetOps

I appreciate the comparison to ansible but I’m not sure i would switch…. :thinking_face:

This reminds me a bit of <https://docs.saltproject.io/en/latest/topics/salt_system_architecture.html#the-salt-system-architecture|Salt>, formerly SaltStack.

Routine use of tools to SSH into virtual machines and especially containers to run commands does seem like an anti-pattern today.

Apart from tools to build and redeploy AMIs and container images, on AWS people should try <https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html|Systems Manager (SSM) Session Manager> or
<https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html|ECS Exec>. These are more secure than SSH (no open port, no SSH keys to manage, centralized access control, centralized logging) and they are not too hard to configure.

An <https://github.com/pyinfra-dev/pyinfra/issues/990|SSM connector won't be included in Pyinfra>, but maybe a third party will write one.

I <https://github.com/search?q=org%3Asaltstack+%22session+manager%22&type=issues|didn't find> anything relevant for Salt.

If Ansible relies on SSH, can it use Session Manager?

<@U08SE2HJ00Y> totally agree.  Any server-based stack i build out these days i don’t even open port 22.  all system level commands go through an SSM session.  I have not tried using ansible over SSM but I would love to see it.

sadly, i still manage some servers that use ansible SSH over public networks ( :interrobang::face_palm::skin-tone-5:) so those ports are open and probed all the time.

I might have been looking into ansible over SSM a while back.  this was commented out in my ssh config:

```# SSH over Session Manager
#host i-*
#   ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=[%p]'"```
:thinking_face:

these interesting stuff is becoming hobbies lol

<@U01FFET39NW>, neat idea, I'd forgotten about the possibility of plugging in to the AWS CLI in that way! If only it were easy to make that a default for all the "minions" in a Salt environment, for example.