AWS SSM Port Forwarding をプライベートサブネット設計に組み込む方法｜IAMポリシー構成

この記事のポイント

・aws ssm start-session でプライベートサブネットのRDS/Redisにローカル接続できる
・VPCエンドポイントは ssm・ssmmessages・ec2messages の3本が必要
・IAMポリシーはドキュメント名とインスタンスIDをResourceで限定して最小権限にする
・セキュリティグループの22番・3306番・5432番の受信ルールは不要になる

# VPCエンドポイントの一覧を確認する
$ aws ec2 describe-vpc-endpoints     --filters "Name=vpc-id,Values=vpc-0a1b2c3d4e5f67890"     --query 'VpcEndpoints[*].{Service:ServiceName,State:State}'     --output table

-------------------------------------------------------------------------------------------
|                               DescribeVpcEndpoints                                      |
+-----------+-----------------------------------------------------------------------------+
|   State   |                           Service                                           |
+-----------+-----------------------------------------------------------------------------+
|  available|  com.amazonaws.ap-northeast-1.ec2messages                                   |
|  available|  com.amazonaws.ap-northeast-1.ssm                                           |
|  available|  com.amazonaws.ap-northeast-1.ssmmessages                                   |
+-----------+-----------------------------------------------------------------------------+

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPortForwarding",
      "Effect": "Allow",
      "Action": "ssm:StartSession",
      "Resource": [
        "arn:aws:ec2:ap-northeast-1:123456789012:instance/i-0123456789abcdef0",
        "arn:aws:ssm:ap-northeast-1::document/AWS-StartPortForwardingSession",
        "arn:aws:ssm:ap-northeast-1::document/AWS-StartPortForwardingSessionToRemoteHost"
      ]
    },
    {
      "Sid": "AllowSessionManagement",
      "Effect": "Allow",
      "Action": [
        "ssm:TerminateSession",
        "ssm:ResumeSession",
        "ssm:DescribeSessions",
        "ssm:GetConnectionStatus"
      ],
      "Resource": "arn:aws:ssm:*:*:session/-*"
    }
  ]
}

# ローカルの15432番をEC2経由でRDS(5432番)へ転送する
$ aws ssm start-session     --target i-0123456789abcdef0     --document-name AWS-StartPortForwardingSession     --parameters '{"portNumber":["5432"],"localPortNumber":["15432"]}'

Starting session with SessionId: tomohiro-0a1b2c3d4e5f67890
Port 15432 opened for sessionId tomohiro-0a1b2c3d4e5f67890.
Waiting for connections...

# EC2(i-0123456789abcdef0)経由でRDSエンドポイントの5432番に転送する
$ aws ssm start-session     --target i-0123456789abcdef0     --document-name AWS-StartPortForwardingSessionToRemoteHost     --parameters '{
        "host":["mydb.cluster-xxxxxxxxxxxx.ap-northeast-1.rds.amazonaws.com"],
        "portNumber":["5432"],
        "localPortNumber":["15432"]
    }'

Starting session with SessionId: tomohiro-0b2c3d4e5f678901
Port 15432 opened for sessionId tomohiro-0b2c3d4e5f678901.
Waiting for connections...

# 実行中のセッションIDを確認する
$ aws ssm describe-sessions --state Active     --query 'Sessions[*].{ID:SessionId,Target:Target,Start:StartDate}'     --output table

---------------------------------------------------------------------------
|                           DescribeSessions                              |
+--------------------------------------+-----------------+----------------+
|                 ID                   |     Start       |    Target      |
+--------------------------------------+-----------------+----------------+
|  tomohiro-0b2c3d4e5f678901           |  2026-10-11T..  |  i-01234...   |
+--------------------------------------+-----------------+----------------+

# セッションを終了する
$ aws ssm terminate-session --session-id tomohiro-0b2c3d4e5f678901

{
    "SessionId": "tomohiro-0b2c3d4e5f678901"
}

# タグ条件でポートフォワーディングを許可する例（マルチAZ対応）
{
  "Effect": "Allow",
  "Action": "ssm:StartSession",
  "Resource": "arn:aws:ec2:ap-northeast-1:123456789012:instance/*",
  "Condition": {
    "StringEquals": {
      "ssm:resourceTag/Env": "prod",
      "ssm:resourceTag/Role": "ssm-bastion"
    }
  }
}