Stop Whitelisting Port 22: SSH into Private EC2 from GitHub Actions via AWS SSM 🔐

7.3 relevance

Practical guide for secure SSH via SSM, directly applicable to cloud infrastructure workflows.

AI/ML dev.to

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a solutions architect focused on secure CI/CD, this removes the operational burden of SSH key rotation, bastion hosts, and dynamic IP whitelisting while enforcing IAM-based access control.

Key Takeaways

Adopt SSM Session Manager with EC2 Instance Connect for zero-trust SSH in your GitHub Actions deployments.

Stop Whitelisting Port 22: SSH into Private EC2 from GitHub Actions via AWS SSM 🔐

Summary

AWS SSM Session Manager eliminates the need for port 22 whitelisting by having the SSM agent initiate an outbound connection, with IAM as the auth layer. The ankurk91/setup-ssh-over-ssm-action GitHub Action automates ephemeral SSH key generation via EC2 Instance Connect (60-second validity) and configures the runner's SSH config, using OIDC for short-lived AWS credentials. No secrets, no static keys, no security group rules.

Author

Ankur K