AWS Managed Instances with SSM and VPN

[SauRoNZA]

At present we have quite a few on-premises (Linux-based) Managed Instances registered in SSM all over the show which works lekker with Session Manager to SSH into them and all those lovely things without needing to push keys to each one like we did historically.

However, a deeper part of the problem is that we've always run an OpenVPN client from all these systems to reach certain services inside our AWS infrastructure that isn't accessible directly from the internet, which works perfectly fine when it works but is a nightmare when certificates expire etc.

So I was wondering if there is any way to leverage the Amazon SSM Agent that already runs a tunnel into the VPC anyway on a permanent basis and completely forget about the VPN concept.

Doing a bit of reading it seems AWS Privatelink should do this, but at the same time it appears like it rather does it in reverse so that you can easily reach the Managed Instance via DNS etc, where I want to do it exactly the other way around.

Did anyone fiddle with this before? And made it work in this fashion?

 

[Thor]

Subs

 

[Tinuva]

Not sure you understand the use of private link, will describe how I see it used.

When you create a completely isolated VPC, as in, it exists entirely of only private subnets, no nat gateway, no internet gateway etc. How do you get instances in this VPC, to call AWS APIs? You create a private link to lets say, the EC2 API. This is something like ec2.af-south-1.amazonaws.com as you know. With private link, you now get ENIs deployed inside this isolated VPC which then act as a proxy to the EC2 gateway. Only now, ec2.af-south-1.amazonaws.com will resolve to private ips inside your VPC so the traffic doesn't need an internet gateway.

As for your use-case, I suspect you need to look at a different type of VPN or a way to automate the certificate updates so that you dont even know its happening.