Ssh – Connecting to Amazon AWS over SSH via IPv6

After reading the VPC documentation more closely, my first EC2 instance is connected.

Here is what i got wrong when setting up the EC2 instance and VPC.

With only a private ip, my development machine would never be able to connect to the EC2 instance unless it was a part of the VPC's network. So to talk to it from the outside, I needed to specify that for every instance created that an associated public ip address be assigned as well.

Here is what did to fix it:

1. Correct me if i am wrong, but it looks like there was not an option in the EC2 browser console to assign a public ip address to the already created instance, So i ended up deleting it.

2. I want back to the VPC console, and went to the subnets option. I then selected the public subnet that was initially created in the VPC wizard and specified in the "Modify Auto-Assign Public IP" option to enable the auto-assignment of a public ip address for every new EC2 instance created.

3. Create a new EC2 instance, and a new public ip address is assigned.

4. Followed amazon's directions for ssh and communication was successfully initiated.

You can set up a bastion host to connect to any instance within your VPC:

http://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC

You can choose to launch a new instance that will function as a bastion host, or use your existing NAT instance as a bastion.

If you create a new instance, as an overview, you will:

1) create a security group for your bastion host that will allow SSH access from your laptop (note this security group for step 4)

2) launch a separate instance (bastion) in a public subnet in your VPC

3) give that bastion host a public IP either at launch or by assigning an Elastic IP

4) update the security groups of each of your instances that don't have a public IP to allow SSH access from the bastion host. This can be done using the bastion host's security group ID (sg-#####).

5) use SSH agent forwarding (ssh -A user@publicIPofBastion) to connect first to the bastion, and then once in the bastion,SSH into any internal instance (ssh user@private-IP-of-Internal-Instance). Agent forwarding takes care of forwarding your private key so it doesn't have to be stored on the bastion instance (never store private keys on any instance!!)

The AWS blog post above should be able to provide some nitty gritty regarding the process. I've also included the below in case you wanted extra details about bastion hosts:

Concept of Bastion Hosts: http://en.m.wikipedia.org/wiki/Bastion_host

If you need clarification, feel free to comment.