Amazon Linux2に標準でインストールされていて、SSHクライアントを使わずにSSMの実行サーバから一斉に処理をかけるといったことが可能です。
目次
環境
- OS: Amazon Linux2
EC2構成
- SSM実行サーバ
SSM-Manager - SSMクライアント
SSM-Client1
SSM-Client2 - SSMクライアントタグ
tag：SSM
value:demo
タグでグループ化します。
EC2 IAMロール
- ロール名
EC2-SSM-Role - ポリシー
AmazonEC2RoleforSSM
AmazonEC2FullAccesss
IAMユーザ
- プログラム用アクセスユーザ
- アクセス権限
AmazonSSMFullAccess
SSMマネージャ設定
SSMの管理用のサーバからコマンドを打てるようにします。
aws configure
ユーザを適用します。
|
1 2 3 4 5 6 7 |
$ aws configure $ aws configure AWS Access Key ID [None]: xxxxxxxxxxxx AWS Secret Access Key [None]: xxxxxxxxxxxxxxxxxxxxxxxxxxx Default region name [None]: ap-northeast-1 Default output format [None]: json |
|
1 2 3 4 5 6 7 8 |
$ aws configure list Name Value Type Location ---- ----- ---- -------- profile <not set> None None access_key ****************aaaa shared-credentials-file secret_key ****************bbbb shared-credentials-file region ap-northeast-1 config-file ~/.aws/config |
一覧取得 SSM管理対象インスタンス
|
1 2 3 4 5 |
$ aws ssm describe-instance-information --output text INSTANCEINFORMATIONLIST 2.3.372.0 ip-172.1.45.101.ap-northeast-1.compute.internal 172.1.45.101 i-xxxxxxxxxxxxxxxxx True 1547987962.59 Online Amazon Linux Linux 2 EC2Instance INSTANCEINFORMATIONLIST 2.3.372.0 ip-172.1.45.102.ap-northeast-1.compute.internal 172.1.45.102 i-aaaaaaaaaaaaaaaaa True 1547987834.81 Online Amazon Linux Linux 2 EC2Instance INSTANCEINFORMATIONLIST 2.3.372.0 ip-172.1.45.103.ap-northeast-1.compute.internal 172.1.45.103 i-bbbbbbbbbbbbbbbbb True 1547988067.82 Online Amazon Linux Linux 2 |
これで一覧が取得出来てなかったら、ロールの適用を行えていない可能性が高い。
タグでSSM、値をdemoとグループ化したインスタンスに”df -h”を実行します
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
$ aws ssm send-command --targets "Key=tag:SSM,Values=demo" --document-name "AWS-RunShellScript" --comment "check volume" --parameters "commands=df -h" { "Command": { "MaxErrors": "0", "Parameters": { "commands": [ "df -h" ] }, "DocumentName": "AWS-RunShellScript", "OutputS3BucketName": "", "OutputS3KeyPrefix": "", "StatusDetails": "Pending", "RequestedDateTime": 1548049163.072, "Status": "Pending", "TargetCount": 0, "NotificationConfig": { "NotificationArn": "", "NotificationEvents": [], "NotificationType": "" }, "InstanceIds": [], "ErrorCount": 0, "MaxConcurrency": "50", "ServiceRole": "", "CloudWatchOutputConfig": { "CloudWatchLogGroupName": "", "CloudWatchOutputEnabled": false }, "DocumentVersion": "", "CompletedCount": 0, "Comment": "check volume", "ExpiresAfter": 1548056363.072, "DeliveryTimedOutCount": 0, "CommandId": "20c3cf30-3e32-4458-89b8-7fe2f34dd793", ←●注目 "Targets": [ { "Values": [ "demo" ], "Key": "tag:SSM" } ] } } |
コマンドIDから結果を取得出来ます。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 |
$ aws ssm list-command-invocations --command-id 20c3cf30-3e32-4458-89b8-7fe2f34dd793 --details { "CommandInvocations": [ { "Comment": "check volume", "Status": "Success", "CommandPlugins": [ { "Status": "Success", "ResponseStartDateTime": 1548049164.141, "StandardErrorUrl": "", "OutputS3BucketName": "", "OutputS3Region": "ap-northeast-1", "OutputS3KeyPrefix": "", "ResponseCode": 0, "Output": "Filesystem Size Used Avail Use% Mounted on\ndevtmpfs 476M 0 476M 0% /dev\ntmpfs 493M 0 493M 0% /dev/shm\ntmpfs 493M 328K 493M 1% /run\ntmpfs 493M 0 493M 0% /sys/fs/cgroup\n/dev/xvda1 8.0G 1.2G 6.9G 15% /\n", "ResponseFinishDateTime": 1548049164.149, "StatusDetails": "Success", "StandardOutputUrl": "", "Name": "aws:runShellScript" } ], "ServiceRole": "", "CloudWatchOutputConfig": { "CloudWatchLogGroupName": "", "CloudWatchOutputEnabled": false }, "InstanceId": "i-0e42fcc335e570cf6", "DocumentName": "AWS-RunShellScript", "NotificationConfig": { "NotificationArn": "", "NotificationEvents": [], "NotificationType": "" }, "DocumentVersion": "", "StatusDetails": "Success", "StandardOutputUrl": "", "StandardErrorUrl": "", "InstanceName": "ip-172.1.45.102.ap-northeast-1.compute.internal", "CommandId": "20c3cf30-3e32-4458-89b8-7fe2f34dd793", "RequestedDateTime": 1548049163.705 }, { "Comment": "check volume", "Status": "Success", "CommandPlugins": [ { "Status": "Success", "ResponseStartDateTime": 1548049164.062, "StandardErrorUrl": "", "OutputS3BucketName": "", "OutputS3Region": "ap-northeast-1", "OutputS3KeyPrefix": "", "ResponseCode": 0, "Output": "Filesystem Size Used Avail Use% Mounted on\ndevtmpfs 476M 0 476M 0% /dev\ntmpfs 493M 0 493M 0% /dev/shm\ntmpfs 493M 328K 493M 1% /run\ntmpfs 493M 0 493M 0% /sys/fs/cgroup\n/dev/xvda1 8.0G 1.2G 6.9G 15% /\n", "ResponseFinishDateTime": 1548049164.069, "StatusDetails": "Success", "StandardOutputUrl": "", "Name": "aws:runShellScript" } ], "ServiceRole": "", "CloudWatchOutputConfig": { "CloudWatchLogGroupName": "", "CloudWatchOutputEnabled": false }, "InstanceId": "i-07360cdbd8b0e4aea", "DocumentName": "AWS-RunShellScript", "NotificationConfig": { "NotificationArn": "", "NotificationEvents": [], "NotificationType": "" }, "DocumentVersion": "", "StatusDetails": "Success", "StandardOutputUrl": "", "StandardErrorUrl": "", "InstanceName": "ip-172.1.45.103.ap-northeast-1.compute.internal", "CommandId": "20c3cf30-3e32-4458-89b8-7fe2f34dd793", "RequestedDateTime": 1548049163.572 } ] } |
ssm-sh
goのインストール
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
$ vi /home/ec2-user/.bashrc # .bashrc # Source global definitions if [ -f /etc/bashrc ]; then . /etc/bashrc fi # Uncomment the following line if you don't like systemctl's auto-paging feature: # export SYSTEMD_PAGER= # User specific aliases and functions ※下記を追加 export GOPATH=$HOME/go export PATH=$PATH:$GOROOT/bin:$GOPATH/bin |
|
1 |
$ source ~/.bashrc |
ssm-shのインストール
|
1 2 |
$ sudo yum install -y git $ go get -u github.com/itsdalmo/ssm-sh |
SSM-SHのインストールの確認
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
$ ssm-sh --help Usage: ssm-sh [OPTIONS] <command> Application Options: -v, --version Print the version and exit. AWS Options: -p, --profile= AWS Profile to use. (If you are not using Vaulted). -r, --region= Region to target. Help Options: -h, --help Show this help message Available commands: describe Description a document from ssm. list List managed instances or documents. (aliases: ls) run Run a command or document on the targeted instances. shell Start an interactive shell. (aliases: sh) |
ヘルプが出てきたらOK
インスタンスに入ってコマンドの実行
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
$ ssm-sh -r ap-northeast-1 shell -t i-aaaaaaaaaaaaaaaa Initialized with targets: [i-aaaaaaaaaaaaaaaa] Type 'exit' to exit. Use ctrl-c to abort running commands. ≫ pwd i-aaaaaaaaaaaaaaaa - Success: /usr/bin ≫ whoami i-aaaaaaaaaaaaaaaa - Success: root ≫ ping -c 3 yahoo.co.jp i-0e42fcc335e570cf6 - Success: PING yahoo.co.jp (183.79.135.206) 56(84) bytes of data. 64 bytes from f1.top.vip.kks.yahoo.co.jp (183.79.135.206): icmp_seq=1 ttl=39 time=14.6 ms 64 bytes from f1.top.vip.kks.yahoo.co.jp (183.79.135.206): icmp_seq=2 ttl=39 time=14.6 ms 64 bytes from f1.top.vip.kks.yahoo.co.jp (183.79.135.206): icmp_seq=3 ttl=39 time=15.1 ms ≫ exit $ |
SSMを利用するとマネージャサーバからクライアントへコマンドを打つことが可能です。
お疲れ様です。
