Secure EC2 Deployments from GitHub Actions Using AWS SSM, No Open Ports Needed

·59 views

Developers deploying to EC2 via GitHub Actions have traditionally relied on long-lived SSH keys, open port 22, or bastion hosts — all of which carry significant security risks. AWS Systems Manager Session Manager eliminates these risks by having the SSM Agent on the instance initiate an outbound HTTPS connection to AWS, removing the need for any inbound security group rules. Combined with EC2 Instance Connect, temporary SSH keys can be pushed to an instance for just 60 seconds, leaving nothing persistent to rotate or leak. IAM policies replace key-file-based authentication, and every session is logged in CloudTrail for full auditability. An open-source GitHub Action, ankurk91/setup-ssh-over-ssm-action, packages this entire setup and teardown process, enabling clean deployments with no stored secrets or open ports.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Reactor essay argues Children of Men reflects the present more than the future

A piece published on Reactor Magazine examines the 2006 film Children of Men and its depiction of a near-future world facing infertility and societal collapse. The essay contends that the film's dystopian themes resonate more strongly with contemporary anxieties than with any forecast of what lies ahead. It is framed as a critical reading of the movie rather than a report on a new event. The source text provided is limited to the link and Hacker News metadata, so the argument is described only at a high level.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Five chmod Permission Traps That Catch Developers Out

Standard tutorials recommend chmod 755 and 644 without explaining the permissions they grant. On directories, the read, write and execute bits behave differently: read lists names, write creates or deletes entries, and execute allows traversal, so a directory set to 666 is readable but unusable. The author also highlights confusion around chmod's = and + operators, the capital X flag for applying execute only where appropriate, and how umask is applied. Misplaced digits can unintentionally set setuid or setgid bits, while redirected file creation can yield overly permissive modes such as 644 for SSH keys. The article recommends install -m 600 for sensitive files and suggests a chmod calculator for verifying modes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Loop order alone makes a 4096x4096 grid sum 13x slower due to CPU cache misses

A DEV Community author compared two functions that sum the same 4096 by 4096 grid, differing only in whether the outer loop walks rows or columns. Row-order summing took about 11 ms on an Apple M3 laptop, while column-order summing took about 146 ms, roughly 13 times slower. The explanation is that the CPU loads memory in fixed-size cache lines, so reading neighboring elements in a row reuses cached data, while jumping between rows in a column forces a memory fetch on nearly every read. The gap appears once the grid exceeds the cache size, and the author notes that a Float64Array shows the same pattern, indicating the cause is memory layout rather than JavaScript arrays. Suggested fixes include keeping the row loop outermost and accumulating column totals in a separate array, which matched the results of the column-order method at about 12 ms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A job offer on LinkedIn came with malware in a Git hook. It's the "Contagious Interview" playbook

A recruiter messaged me on LinkedIn about building the website for a blockchain basketball game. Then they sent a documentation pack as a .tar.gz file. The plan was simple: review the docs, sign the NDA, then we'd schedule a call. The docs were real enough to read. The archive also held a Git hook that would have downloaded a script and run it on my Mac the first time I checked out a branch.

0 comments Read more at DEV Community