问题描述
问题：
当我尝试使用AWS System Session Manager CLI命令本地连接到正在运行的EC2实例时：aws ssm start-session --target i-123456
我得到了错误：
An error occurred (TargetNotConnected) when calling the StartSession operation: i-123456 is not connected.
背景：
com.amazonaws.us-west-2.s3
com.amazonaws.us-west-2.ec2
com.amazonaws.us-west-2.ec2messages
com.amazonaws.us-west-2.ssm
com.amazonaws.us-west-2.ssmmessages
- AWS CLI == 2.0.40
- Python == 3.7.4
- 自定义terraform模块，以在一个私有子网中启动气流实例（请参见下面的模块“ airflow_aws_resources”）
- 唯一与此问题相关的.tf文件是模块“ airflow_aws_resources”中的airflow.tf。该文件包含通过SSM连接的EC2实例的安全组和实例配置文件配置。
使用terraform复制：
module "airflow_aws_resources" {
source = "github.com/marshall7m/tf_modules/airflow-aws-resources"
resource_prefix = "test"
vpc_id = module.vpc.vpc_id
env = "testing"
private_bucket = "test-bucket"
private_subnets_ids = module.vpc.private_subnets
private_subnets_cidr_blocks = module.vpc.private_subnets_cidr_blocks
create_airflow_instance = true
create_airflow_instance_sg = true
create_airflow_db = false
create_airflow_db_sg = false
airflow_instance_ssm_access = true
airflow_instance_ssm_region = "us-west-2"
airflow_instance_ami = "ami-0841edc20334f9287"
airflow_instance_type = "t2.micro"
}
resource "aws_security_group" "vpc_endpoints" {
name = "test-vpc-endpoint-sg"
description = "Default security group for vpc endpoints"
vpc_id = module.vpc.vpc_id
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["10.0.0.32/28","10.0.0.64/28"]
}
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
#private subnet cidr blocks
cidr_blocks = ["10.0.0.32/28","10.0.0.64/28"]
}
egress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["10.0.0.32/28","10.0.0.64/28"]
}
egress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["10.0.0.32/28","10.0.0.64/28"]
}
}
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "2.44.0"
name = "test-vpc"
cidr = "10.0.0.0/24"
azs = ["us-west-2a","us-west-2b"]
private_subnets = ["10.0.0.32/28","10.0.0.64/28"]
private_dedicated_network_acl = true
private_subnet_suffix = "private"
public_subnets = ["10.0.0.96/28","10.0.0.128/28"]
public_dedicated_network_acl = true
public_subnet_suffix = "public"
enable_s3_endpoint = true
enable_ec2messages_endpoint = true
ec2messages_endpoint_security_group_ids = [aws_security_group.vpc_endpoints.id]
enable_ec2_endpoint = true
ec2_endpoint_security_group_ids = [aws_security_group.vpc_endpoints.id]
enable_ssm_endpoint = true
ssm_endpoint_security_group_ids = [aws_security_group.vpc_endpoints.id]
enable_ssmmessages_endpoint = true
ssmmessages_endpoint_security_group_ids = [aws_security_group.vpc_endpoints.id]
enable_nat_gateway = false
single_nat_gateway = false
enable_vpn_gateway = false
create_database_subnet_route_table = false
create_database_internet_gateway_route = false
create_database_subnet_group = false
manage_default_network_acl = false
enable_dns_hostnames = true
enable_dns_support = true
private_inbound_acl_rules = [
{
"description": "Allows inbound https traffic for aws s3 package requests"
"cidr_block": "0.0.0.0/0","from_port": 443,"to_port": 443,"protocol": "tcp","rule_action": "allow","rule_number": 101
},{
"description": "Allows inbound http traffic for aws s3 package requests"
"cidr_block": "0.0.0.0/0","from_port": 80,"to_port": 80,"rule_number": 102
}
]
private_outbound_acl_rules = [
{
"description": "Allows outbound https traffic for aws s3 package requests"
"cidr_block": "0.0.0.0/0",{
"description": "Allows outbound http traffic for aws s3 package requests"
"cidr_block": "0.0.0.0/0","rule_number": 102
}
]
vpc_endpoint_tags = {
type = "vpc-endpoint"
}
}
尝试：
＃1
我尝试了EC2控制台SSM（AWS Ec2控制台>>实例ID >>连接>>会话管理器）中的故障排除技巧：
-
SSM代理已预先安装在AWS Linux实例类型上。尽管我通过SSH访问实例并运行返回了
的sudo status amazon-ssm-agentamazon-ssm-agent start/running,process 1234进行了两次检查 -
我已完成会话管理器先决条件。
＃2
使用以下命令将AmazonSSMFullAccess附加到用户：aws ssm start-session --target i-123456
通过SSM连接实例时出现相同错误：
An error occurred (TargetNotConnected) when calling the StartSession operation: i-123456 is not connected.
＃3
将来自VPC端点的关联专用子网的HTTPS入站/出站流量添加到EC2实例安全组（请参见airflow.tf）
相同错误：
An error occurred (TargetNotConnected) when calling the StartSession operation: i-123456 is not connected.
＃4
在系统管理器控制台中，我使用了“快速设置”选项，并为快速设置配置了airflow.tf中指定的实例配置文件，并为系统管理器角色配置了默认角色。 ec2实例在快速设置页面中成功注册了“托管实例”。
相同错误：
An error occurred (TargetNotConnected) when calling the StartSession operation: i-123456 is not connected.
＃5
鉴于这是一个测试VPC和EC2实例，我尝试为以下资源允许来自所有IPv4源（0.0.0.0/0）的所有类型的流量：
- 私有子网NACL
- EC2实例安全组
- 与以下接口/网关端点关联的安全组：
com.amazonaws.us-west-2.s3
com.amazonaws.us-west-2.ec2
com.amazonaws.us-west-2.ec2messages
com.amazonaws.us-west-2.ssm
com.amazonaws.us-west-2.ssmmessages
通过SSM连接实例时出现相同错误：
An error occurred (TargetNotConnected) when calling the StartSession operation: i-123456 is not connected.
解决方法
我会refer here 确保您已正确设置所有内容。我将首先添加配置文件参数。如果这仍然不起作用，当我的配置文件默认区域与我希望开始活动会话的区域不同时，我遇到了类似的问题。因此，我还需要使用 region 参数。下面的示例 .ssh/config：
host ssh i-abc123
ProxyCommand sh -c "aws --region desired_region --profile my_profile ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
我也鼓励使用 AWS CLI v2。将 .ssh/config 配置为如上所示后，只需在 CLI 中执行以下操作：
ssh i-abc123
当我尝试从终端连接时也遇到同样的错误：An error occurred (TargetNotConnected) when calling the StartSession operation: i-122334455 is not connected.
就我而言，问题是安装在目标实例上的 SSM 已过期。我通过尝试从 AWS 控制台中的 Systems Manager 启动会话发现了这一点；基本上去 Systems Manager->Fleet Manager->{INSTANCE_ID}->Instance Actions->Start Session。当我尝试这样做时，我收到错误消息，指出目标 ec2 实例上的 SSM 代理已过期。更新后，我可以成功登录了。
要更新，您可以为所有托管实例启用 SSM 代理自动更新、手动更新特定实例或对托管实例进行选择性更新。有关信息，请参阅以下文档：
- https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-troubleshooting.html#session-manager-troubleshooting-instances
- https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-automatic-updates.html
- https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-manual-agent-install.html
因此，您可能需要使用配置文件。我正在OSX上使用AWS CLI通过终端连接到VPC中的linux主机。这是只能通过SSO访问的帐户。我能够创建一个配置文件，并通过CLI向SSO进行身份验证后，可以建立这样的连接。
执行一次
aws sso login --profile my_customer
然后使用简单命令（在我的osx终端上）验证sso登录是否成功
aws s3 ls --profile my_customer custbucket-s3-sftp/rds/
现在建立会话管理器连接
aws ssm start-session --profile my_customer --target i-0012345abcdef890
我知道您正在使用python，但这也许会有所帮助。
,在某些情况下，您必须验证以下内容：
- AWS 账户/配置文件
- AWS 区域
在一种情况下，我发现它正在尝试连接到 aws 配置文件。
后来在其他情况下，我连接到了不同的区域。
,将公共弹性IP与实例相关联的技巧使我可以通过SSM会话管理器连接到实例