Remote Development on AWS EC2 with VSCode

Motivations

VSCode native development has grown to be a popular choice for many developers. Creating a VSCode native development environment for all team members will not only ensure a consistant development experience, but also reduce the onboarding time for new team members. With growing popularity of cloud computing, this blog aims to discuss a few common practical setups to enable a VSCode native development environment for AWS EC2.

Introduction

VSCode supports remote connection via SSH, which is traditionally the de fecto route for remote development. However, SSH is not the only option, and due to the increaseing restrictions of SSH key pairs under corperate environment to avoid cyber attack (reducing attack surface), alternative connecting mechanism to cloud infrastructure like via Amazon simple systems manager (SSM) will be discuss futher in this post.

EC2 and Local Requirements

• EC2 does not have a public IP address
• EC2 is in a private subnet and managed by AWS systems manager (SSM)
• AWS IAM role allows policy AmazonSSMManagedInstanceCore and AmazonSSMFullAccess (min ssm:SendCommand)
  An example of quick start policy for SSM session manager

{
    "Version": "2023-11-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ssm:StartSession",
            "Resource": [
                "arn:aws:ec2:region:account-id:instance/instance-id",
                "arn:aws:ssm:*:*:document/AWS-StartSSHSession"
            ],
            "Condition": {
                "BoolIfExists": {
                    "ssm:SessionDocumentAccessCheck": "true"
                }
             }
        }
    ]
}

• EC2 instance runs on a latest supported Linux AMI where possible
• Local has AWS CLI and AWS CLI session manager plug-in (> version 1.1.23.0) installed
• Local has SSH client version

Setups

Synopsis:
Instead of direct tunneling via SSH, use AWS SSM to establish a secure connection to the EC2 instance by port forwarding.

1. Prepare a SSH key pair for the EC2 instance
   • Use existing key pairs of your choice.
   • Generating a new key pair with SSH, a more detailed guide on using SSH key with AWS can be found here or SSH key-gen operations can be found here.

      ssh-keygen -t rsa -b 4096 -C "<msg - email>"
     

2. Uploading Pubkey to AWS
   • Upload the public key to AWS EC2 instance, a more detailed guide can be found here.
3. Config local SSH client

   • Edit SSH config file with your choice of editor, for example, nano or text editor

   • Also possible to configure directly inside VSCode, call Remote-SSH: Open Configuration File... from the Command Palette (F1) to open SSH client config file, for underline Linux system commonly located at ~/.ssh/config
     
   • For underline Windows system, the config file is located at C:\Users\<username>\.ssh\config
4. Connect to EC2
   • To connect to EC2 via VSCode, call the command palette (F1) and select Remote-SSH: Connect to Host... and select the host from the list.
   • Also possible to use a VSCode remote plugin Remote - SSH or Remote Explorer.