There's been a recent argument being made that SSM is safer (or more secure) than SSH. While this may be true for very specific cases, I tend to disagree with the blanketing statement that SSM is safer than SSH. Seeking thoughts and/or discussion on this.
Two arguments that can be made in favor of SSM are:
No need to open a port to "ssh"
- Cool but if you end up opening a bunch of other ports (443/80/etc.), then who cares at that point. Let us assume that we only need remote access (port 22). Proper setup of SSH (along with an open port 22) does not pose high risk.
Key rotation no longer required
- Cool, so one less thing to think about for SSM. But, what about all the ssm agents that need patching, what about all the IAM roles that need maintenance and management (think cross account iam role assumes and stuff). Then you have all the custom wrappers for SSM that need to be created and maintained to force users to use - now all these wrappers and scripts are potentially vulnerable.
Here are some arguments against SSM:
Kills portability especially if the application itself starts using SSM (vs the infrastructure)
closed source
if developers/teams are forced to use SSM (or any tech), it slows down teams and may even demoralize them. If demoralized, now devs aren't loving what they are working on - once again potential to introduce vulnerabilities.
If we use SSM for nodes, but still end up opening ports on said nodes - that introduces a whole new level of weirdness - because now SSM gives the false impression that API calls are being made without open ports, when in reality nodes are open (independent of SSM).
Not able to handle long lived ssh sessions
Not as smooth as SSH
Not as universal as SSH
The underlying nodes themselves need some form of outgoing internet to be able to use SSM
Further arguments:
SSH + MFA exists and brings SSH to an even higher level of security
SSH + identity provider integration also exists and brings SSH to an even higher level of security
If someone was properly using SSH, the only way for a nefarious user to assume this connection is by stealing the key physically (acquiring victim's machine with it being unlocked). At that point, if it is SSM (iam creds) or SSH (keys) - both are pwned. If SSH was setup with MFA or even a passphrase, SSH would actually be more secure than SSM.
Any thoughts/arguments/corrections would be appreciated.
Thank you.
