Find out ECS AMI username to be able to ssh using EC2 Instance Connect Endpoint

Question

I am trying to leverage this "EC2 Instance Connect Endpoint" feature to ssh using by browser to instances that do not have any public IP. It works fine if I start an instance using an Amazon Linux ami. However, it does not with my services deployed with ECS backed by EC2 and I get this very generic error message:
Failed to connect to your instance
Error establishing SSH connection to your instance. Try again later.

I tried created an instance manually using the same ami (ami-090310a05d8eae025 - amazon/amzn2-ami-ecs-hvm-2.0.20230428-x86_64-ebs
) and it does not work as well, so I suspect something is different in this image than the vanilla Amazon Linux one. The default username seems to be "ec2-user" but how do I verify that this ami uses the same one? Is there any other trick that this ami could do differently that would prevent me from connecting?

myronix88 · Answer

Hi,

Please check 2 things:
1. If VPC of EC2 Instance Connect Endpoint is the same as EC2 VPC.
2. Check SG of EC2 Instance Connect Endpoint. SG EC2 Instance Connect Endpoint should allow SSH TCP 22 for outbound traffic. SG of EC2 should have inbound rule that allows SG of EC2 Instance Connect Endpoint.

Didier_Durand · Answer

Hi,

It's not a direct reponse to your question but it may help you get the answer: AWS has open-sourced the scripts used to build the Amazon ECS-optimized Linux AMIs.

See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-ami-build-scripts.html

Those scripts are available at https://github.com/aws/amazon-ecs-ami

By analyzing them, you will see if they contain any settings preventing the use of EC2 Instance Connect Endpoint. You can also adapt them to your specific needs (and make sure that you can have ssh connection)

Best,

Didier

epot · Answer

Hey!

All this seems to work. Again, I am testing with the same VPC and SG, and I get it working with a different AMI. But for some reason, it does not work with the ECS AMI.

Find out ECS AMI username to be able to ssh using EC2 Instance Connect Endpoint

Relevant content