aws-ssh-utils 0.2.7__tar.gz → 0.3.0__tar.gz

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: aws-ssh-utils
-Version: 0.2.7
+Version: 0.3.0
 Summary: Easy AWS SSHing
 Project-URL: Homepage, https://github.com/mvanderlee/aws-ssh-utils
 Author-email: Michiel Vanderlee <jmt.vanderlee@gmail.com>
@@ -26,7 +26,9 @@ Requires-Dist: boto3
 Requires-Dist: click
 Requires-Dist: loguru
 Requires-Dist: paramiko
+Requires-Dist: ptyprocess>=0.7.0; sys_platform != 'win32'
 Requires-Dist: pyte>=0.8.2
+Requires-Dist: pywinpty>=3.0.0; sys_platform == 'win32'
 Requires-Dist: questionary
 Requires-Dist: requests>=2.34.2
 Requires-Dist: rich>=15.0.0
@@ -58,17 +60,21 @@ It utilizes [questionary](https://pypi.org/project/questionary/) to ask you whic
 
 ## App
 
-Terminal UI to browse EC2 instances and EMR clusters, with SSH shells in tabs.
+Terminal UI to browse EC2 instances and EMR clusters, with SSM or SSH shells in tabs.
 It's the default command, so `aws_ssh` and `aws_ssh -p my-profile` launch it too.
-Each connection tries, in order: `~/.ssh/config`, SSH over AWS SSM (`session-manager-plugin`), opkssh (via instance/cluster tags),
+Each connection tries, in order: `~/.ssh/config`, a keyless AWS SSM shell, opkssh (via instance/cluster tags),
 the instance's EC2 key found in `~/.ssh`, then your default keys/ssh-agent.
-Unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
+SSM uses `aws ssm start-session --target INSTANCE_ID` with the selected profile and region. It requires the AWS CLI,
+`session-manager-plugin`, and Session Manager access to the instance, but no SSH key, SSH server, or inbound port 22.
+The shell runs as the Session Manager configured user (usually `ssm-user`); SSH usernames and key options only apply
+to SSH connections. The `ec2` and `emr` commands use the same connection order; `emr-all` still uses SSH in tmux.
+For SSH connections, unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
 
 ```shell
 $ aws_ssh app --help
 Usage: aws_ssh app [OPTIONS]
 
-  Browse EC2 instances and EMR clusters, and open SSH shells in tabs.
+  Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs.
 
 Options:
   -p, --profile TEXT          Which AWS profile to use
@@ -92,7 +98,7 @@ $ aws_auth ec2 --help
 Usage: aws_ssh ec2 [OPTIONS]
 
   Asks user which EC2 instance they want to connect to, then opens an
-  interactive SSH session to the instance
+  interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use
@@ -114,7 +120,7 @@ Select the EMR cluster, instance group, and instance to connect to.
 $ aws_ssh emr --help
 Usage: aws_ssh emr [OPTIONS]
 
-  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/README.md

@@ -22,17 +22,21 @@ It utilizes [questionary](https://pypi.org/project/questionary/) to ask you whic
 
 ## App
 
-Terminal UI to browse EC2 instances and EMR clusters, with SSH shells in tabs.
+Terminal UI to browse EC2 instances and EMR clusters, with SSM or SSH shells in tabs.
 It's the default command, so `aws_ssh` and `aws_ssh -p my-profile` launch it too.
-Each connection tries, in order: `~/.ssh/config`, SSH over AWS SSM (`session-manager-plugin`), opkssh (via instance/cluster tags),
+Each connection tries, in order: `~/.ssh/config`, a keyless AWS SSM shell, opkssh (via instance/cluster tags),
 the instance's EC2 key found in `~/.ssh`, then your default keys/ssh-agent.
-Unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
+SSM uses `aws ssm start-session --target INSTANCE_ID` with the selected profile and region. It requires the AWS CLI,
+`session-manager-plugin`, and Session Manager access to the instance, but no SSH key, SSH server, or inbound port 22.
+The shell runs as the Session Manager configured user (usually `ssm-user`); SSH usernames and key options only apply
+to SSH connections. The `ec2` and `emr` commands use the same connection order; `emr-all` still uses SSH in tmux.
+For SSH connections, unknown host keys are accepted and appended to `~/.ssh/known_hosts`; changed host keys are rejected.
 
 ```shell
 $ aws_ssh app --help
 Usage: aws_ssh app [OPTIONS]
 
-  Browse EC2 instances and EMR clusters, and open SSH shells in tabs.
+  Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs.
 
 Options:
   -p, --profile TEXT          Which AWS profile to use
@@ -56,7 +60,7 @@ $ aws_auth ec2 --help
 Usage: aws_ssh ec2 [OPTIONS]
 
   Asks user which EC2 instance they want to connect to, then opens an
-  interactive SSH session to the instance
+  interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use
@@ -78,7 +82,7 @@ Select the EMR cluster, instance group, and instance to connect to.
 $ aws_ssh emr --help
 Usage: aws_ssh emr [OPTIONS]
 
-  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSM or SSH session to the instance
 
 Options:
   -p, --profile TEXT    Which AWS profile to use

aws_ssh_utils-0.3.0/aws_ssh_utils/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/aws_ssh_utils/commands/app.py

@@ -48,7 +48,7 @@ ANIMATION_INTERVAL = 1 / 12
 @click.option('-r', '--region', default=None, help='Which AWS region to use')
 @scrollback_option
 def app(profile: str | None = None, region: str | None = None, scrollback: int | None = None, **kwargs: Any):
-    """Browse EC2 instances and EMR clusters, and open SSH shells in tabs."""
+    """Browse EC2 instances and EMR clusters, and open SSM or SSH shells in tabs."""
     try:
         session = boto3.Session(profile_name=profile, region_name=region)
         session.client('sts').get_caller_identity()

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/aws_ssh_utils/commands/ec2.py

@@ -41,7 +41,7 @@ def ec2(
 ):
     """
     Asks user which EC2 instance they want to connect to,
-    then opens an interactive SSH session to the instance
+    then opens an interactive SSM or SSH session to the instance
     """
     session = boto3.Session(profile_name=profile, region_name=region)
     ec2_client = session.client('ec2')

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/aws_ssh_utils/commands/emr.py

@@ -45,7 +45,7 @@ def emr(
 ):
     """
     Asks user which Cluster and EC2 instance they want to connect to,
-    then opens an interactive SSH session to the instance
+    then opens an interactive SSM or SSH session to the instance
     """
     session = boto3.Session(profile_name=profile, region_name=region)
     emr_client = session.client('emr')
@@ -65,9 +65,11 @@ def emr(
     with spinner():
         target = emr_target(emr_client, cluster_id, instance_ip.instance_id or '', ip)
     target = replace(target, user=user or target.user, key_file=key_file)
+    env = detect_environment(profile, session.region_name)
 
     if (
-        key_file is None
+        not env.ssm_installed
+        and key_file is None
         and target.opkssh_provider is None
         and find_ssh_key_file(target.key_name) is None
         and not questionary.confirm(f'Could not find the ssh key {target.key_name}, would you like to continue?').unsafe_ask()
@@ -78,7 +80,7 @@ def emr(
     postfix = f'[{group_idx}]' if group_idx else ''
     open_shell(
         target,
-        detect_environment(profile, session.region_name),
+        env,
         title=f'{cluster_name} - {group}{postfix}',
         scrollback=scrollback,
         initial_input=CORE_NODE_INPUT if group.lower().startswith('core') else b'',

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/aws_ssh_utils/connection.py

@@ -1,4 +1,4 @@
-"""SSH connection strategies, tried in order until one succeeds."""
+"""SSM and SSH connection strategies, tried in order until one succeeds."""
 
 import os
 import shlex
@@ -18,6 +18,8 @@ import paramiko
 from loguru import logger
 from typing_extensions import override
 
+from aws_ssh_utils.session import ShellChannel, SSMSession
+
 # CSV of issuer,client
 OPKSSH_PROVIDER_TAG = 'opkssh_provider'
 # EMR doesn't support comma's in tags.
@@ -54,7 +56,7 @@ class Environment:
 
 @dataclass(frozen=True)
 class Connection:
-    client: paramiko.SSHClient
+    client: paramiko.SSHClient | SSMSession
     via: str
     """How the connection was made: AWS SSM, opkssh, a key name, ..."""
 
@@ -64,7 +66,7 @@ class Attempt:
     via: str
     command: str
     """The equivalent command line, to retry by hand."""
-    open_client: Callable[[], paramiko.SSHClient] = field(repr=False, compare=False)
+    open_client: Callable[[], paramiko.SSHClient | SSMSession] = field(repr=False, compare=False)
     state: Literal['pending', 'connecting', 'connected', 'failed', 'skipped'] = 'pending'
     detail: str = ''
     """The error when failed, the reason when skipped."""
@@ -85,7 +87,7 @@ def connect(
 
     Tried in order:
     1. ~/.ssh/config, when a Host pattern (other than `*`) matches the instance id, an alias or the IP.
-    2. SSH over AWS SSM to the instance id, with any existing opkssh/EC2 key plus the default keys.
+    2. A keyless AWS SSM shell, authenticated with the AWS profile.
     3. opkssh, when the instance/cluster has opkssh tags. May open a browser login.
     4. The EC2 key pair (or `target.key_file`), when a matching file is found in ~/.ssh.
     5. The ssh-agent and default ~/.ssh/id_* keys.
@@ -96,6 +98,24 @@ def connect(
     open_ssh_ = partial(open_ssh, confirm_host_key=confirm_host_key)
     attempts: list[Attempt] = []
 
+    def try_attempt(i: int) -> Connection | None:
+        attempt = attempts[i]
+        if attempt.state == 'skipped':
+            on_progress(list(attempts))
+            return None
+        attempts[i] = replace(attempt, state='connecting')
+        on_progress(list(attempts))
+        try:
+            client = attempt.open_client()
+        except Exception as e:
+            logger.debug(f"Failed to connect via {attempt.via}: {e!r}")
+            attempts[i] = replace(attempt, state='failed', detail=str(e) or type(e).__name__)
+            on_progress(list(attempts))
+            return None
+        attempts[i] = replace(attempt, state='connected')
+        on_progress(list(attempts))
+        return Connection(client, attempt.via)
+
     config = find_ssh_config(target)
     if config is not None:
         alias, options = config
@@ -107,21 +127,18 @@ def connect(
             ),
         )
 
-    ec2_key = target.key_file or find_ssh_key_file(target.key_name)
-    known_keys = [k for k in (valid_opkssh_key_file(target.opkssh_provider), ec2_key) if k]
-    ssm_proxy = ssm_command(target.instance_id, env)
-    ssm = Attempt(
-        "AWS SSM",
-        ssh_command(target.user, target.instance_id, known_keys, proxy=ssm_proxy),
-        lambda: open_ssh_(
-            target.instance_id,
-            target.user,
-            known_keys,
-            use_defaults=True,
-            sock=proxy_socket(ssm_proxy, on_output),
-        ),
+    command = ssm_command(target.instance_id, env)
+    ssm = Attempt('AWS SSM', shlex.join(command), lambda: SSMSession.open(command))
+    attempts.append(
+        ssm if env.ssm_installed else replace(ssm, state='skipped', detail="AWS CLI or session-manager-plugin not installed"),
     )
-    attempts.append(ssm if env.ssm_installed else replace(ssm, state='skipped', detail="session-manager-plugin not installed"))
+    for i in range(len(attempts)):
+        if result := try_attempt(i):
+            return result
+
+    # Key discovery is only needed for the remaining SSH fallbacks.
+    fallback_start = len(attempts)
+    ec2_key = target.key_file or find_ssh_key_file(target.key_name)
 
     if (provider := target.opkssh_provider) is not None:
         opkssh_key = str(opkssh_key_path(provider))
@@ -150,21 +167,9 @@ def connect(
         ),
     )
 
-    for i, attempt in enumerate(attempts):
-        if attempt.state == 'skipped':
-            continue
-        attempts[i] = replace(attempt, state='connecting')
-        on_progress(list(attempts))
-        try:
-            client = attempt.open_client()
-        except Exception as e:
-            logger.debug(f"Failed to connect via {attempt.via}: {e!r}")
-            attempts[i] = replace(attempt, state='failed', detail=str(e) or type(e).__name__)
-            on_progress(list(attempts))
-            continue
-        attempts[i] = replace(attempt, state='connected')
-        on_progress(list(attempts))
-        return Connection(client, attempt.via)
+    for i in range(fallback_start, len(attempts)):
+        if result := try_attempt(i):
+            return result
     return None
 
 
@@ -226,7 +231,9 @@ def ssh_command(
     return shlex.join([*cmd, f'{user}@{host}'])
 
 
-def open_shell_channel(client: paramiko.SSHClient) -> paramiko.Channel:
+def open_shell_channel(client: paramiko.SSHClient | SSMSession) -> ShellChannel:
+    if isinstance(client, SSMSession):
+        return client
     channel = client.get_transport().open_session()  # pyright: ignore[reportOptionalMemberAccess]
     channel.get_pty(term='xterm-256color')
     channel.invoke_shell()
@@ -301,10 +308,6 @@ def ssm_command(instance_id: str, env: Environment) -> list[str]:
         'start-session',
         '--target',
         instance_id,
-        '--document-name',
-        'AWS-StartSSHSession',
-        '--parameters',
-        'portNumber=22',
     ]
     if env.profile:
         cmd += ['--profile', env.profile]

aws_ssh_utils-0.3.0/aws_ssh_utils/session.py

@@ -0,0 +1,128 @@
+"""Terminal channels for native, keyless Session Manager shells."""
+
+import os
+import queue
+import re
+import threading
+import time
+from typing import Protocol, cast
+
+
+class ShellChannel(Protocol):
+    def recv(self, nbytes: int, /) -> bytes: ...
+    def send(self, data: bytes, /) -> int: ...
+    def resize_pty(self, width: int, height: int) -> None: ...
+
+
+class ShellClient(Protocol):
+    def close(self) -> None: ...
+
+
+class Pty(Protocol):
+    def read(self, size: int) -> str: ...
+    def write(self, data: str) -> int: ...
+    def setwinsize(self, rows: int, cols: int) -> None: ...
+    def close(self, force: bool = False) -> None: ...
+
+
+def spawn_pty(command: list[str]) -> Pty:
+    """SSM needs a real terminal for raw input, control keys, and window sizes."""
+    env = {**os.environ, 'TERM': 'xterm-256color', 'AWS_PAGER': '', 'AWS_CLI_AUTO_PROMPT': 'off'}
+    if os.name == 'nt':
+        from winpty import PtyProcess
+
+        return cast(Pty, PtyProcess.spawn(command, env=env, dimensions=(24, 80)))
+
+    from ptyprocess import PtyProcessUnicode
+
+    return cast(Pty, PtyProcessUnicode.spawn(command, env=env, dimensions=(24, 80), echo=False))
+
+
+class SSMSession:
+    """Adapt an AWS CLI pseudo-terminal to the terminal widget's channel interface."""
+
+    def __init__(self, process: Pty):
+        self.process = process
+        self.closed = False
+        self._output: queue.Queue[bytes | Exception | None] = queue.Queue()
+        self._pending = b''
+        self._eof = False
+        threading.Thread(target=self._read, daemon=True).start()
+
+    @classmethod
+    def open(cls, command: list[str], timeout: float = 30) -> 'SSMSession':
+        session = cls(spawn_pty(command))
+        try:
+            session._wait_started(timeout)
+        except BaseException:
+            session.close()
+            raise
+        return session
+
+    def _read(self):
+        try:
+            while not self.closed:
+                data = self.process.read(65536)
+                if data:
+                    self._output.put(data.encode('utf-8'))
+        except EOFError:
+            pass
+        except Exception as e:
+            if not self.closed:
+                self._output.put(e)
+        finally:
+            self._output.put(None)
+
+    def _wait_started(self, timeout: float):
+        """Keep startup output for the terminal, but report CLI failures to the fallback list."""
+        deadline = time.monotonic() + timeout
+        output = bytearray()
+        try:
+            while True:
+                data = self._output.get(timeout=max(0, deadline - time.monotonic()))
+                if isinstance(data, Exception):
+                    raise OSError(str(data)) from data
+                if data is None:
+                    raise OSError(output.decode('utf-8', errors='replace').strip() or 'SSM exited before starting a session')
+                output.extend(data)
+                # ConPTY adds terminal escape sequences to console output on Windows.
+                text = re.sub(rb'\x1b\[[0-?]*[ -/]*[@-~]', b'', output)
+                if re.search(rb'Starting session with SessionId:\s*\S+', text):
+                    self._pending = bytes(output)
+                    return
+        except queue.Empty:
+            detail = output.decode('utf-8', errors='replace').strip()
+            raise TimeoutError(f'Timed out starting SSM session{": " + detail if detail else ""}') from None
+
+    def recv(self, nbytes: int) -> bytes:
+        if nbytes <= 0:
+            return b''
+        while not self._pending and not self._eof:
+            data = self._output.get()
+            if isinstance(data, Exception):
+                raise OSError(str(data)) from data
+            if data is None:
+                self._eof = True
+            else:
+                self._pending = data
+        data, self._pending = self._pending[:nbytes], self._pending[nbytes:]
+        return data
+
+    def send(self, data: bytes) -> int:
+        try:
+            self.process.write(data.decode('utf-8'))
+        except EOFError as e:
+            raise OSError('SSM session is closed') from e
+        return len(data)
+
+    def resize_pty(self, width: int, height: int):
+        if not self.closed:
+            self.process.setwinsize(height, width)
+
+    def close(self):
+        if not self.closed:
+            self.closed = True
+            try:
+                self.process.close(force=True)
+            finally:
+                self._output.put(None)

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/aws_ssh_utils/terminal.py

@@ -1,4 +1,4 @@
-"""Textual widgets rendering a paramiko shell channel through the pyte VT100 emulator."""
+"""Textual widgets rendering SSH and SSM shell channels through the pyte VT100 emulator."""
 
 import datetime as dt
 import time
@@ -7,7 +7,6 @@ from collections.abc import Sequence
 from functools import lru_cache
 from typing import Any
 
-import paramiko
 import pyte
 from pyte.screens import Char, Margins
 from rich.segment import Segment
@@ -22,6 +21,8 @@ from textual.widget import Widget
 from textual.widgets import Static
 from typing_extensions import override
 
+from aws_ssh_utils.session import ShellChannel, ShellClient
+
 KEYS = {
     'enter': '\r',
     'tab': '\t',
@@ -108,7 +109,7 @@ def cell_style(
 class ChannelScreen(pyte.Screen):
     """Answers terminal queries over the channel, and keeps the lines scrolled off the top as history."""
 
-    def __init__(self, channel: paramiko.Channel, columns: int, lines: int, scrollback: int = 0):
+    def __init__(self, channel: ShellChannel, columns: int, lines: int, scrollback: int = 0):
         super().__init__(columns, lines)
         self.channel = channel
         self.history: deque[tuple[Char, ...]] = deque(maxlen=scrollback)
@@ -145,7 +146,7 @@ class Terminal(Widget, can_focus=True):
     class Closed(Message):
         pass
 
-    def __init__(self, client: paramiko.SSHClient, channel: paramiko.Channel, scrollback: int = 0, **kwargs: object):
+    def __init__(self, client: ShellClient, channel: ShellChannel, scrollback: int = 0, **kwargs: object):
         super().__init__(**kwargs)  # pyright: ignore[reportArgumentType]
         self.client = client
         self.channel = channel
@@ -287,7 +288,7 @@ class ShellApp(App[None]):
     # Its priority ctrl+p binding would steal shell history navigation from the terminal.
     ENABLE_COMMAND_PALETTE = False
 
-    def __init__(self, via: str, client: paramiko.SSHClient, channel: paramiko.Channel, scrollback: int = 0):
+    def __init__(self, via: str, client: ShellClient, channel: ShellChannel, scrollback: int = 0):
         super().__init__()
         self.via = via
         self.client = client

{aws_ssh_utils-0.2.7 → aws_ssh_utils-0.3.0}/pyproject.toml

@@ -34,6 +34,8 @@ dependencies = [
   "loguru",
   "paramiko",
   "pyte>=0.8.2",
+  "ptyprocess>=0.7.0; sys_platform != 'win32'",
+  "pywinpty>=3.0.0; sys_platform == 'win32'",
   "questionary",
   "requests>=2.34.2",
   "rich>=15.0.0",

aws_ssh_utils-0.2.7/aws_ssh_utils/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.7"