ssh config with dynamic IP

Question

I have a EC2 instance with a dynamic IP and I would like to connect to it directly without having to modify the .ssh/config every time it changes.

I can query the ip with

aws ec2 describe-instances --filters 'Name=tag:Name,Values=MYTAG' --query 'Reservations[0].Instances[0].NetworkInterfaces[0].Association.PublicIp' --output text

Now, I want to add this command to the ProxyCommand section in my .ssh/config file but I'm getting some errors.

This is the section for that host

Host ec2-instance
     User ubuntu
     IdentityFile my/pem/file.pem
     ProxyCommand bash -c "host=$(aws ec2 describe-instances --filters 'Name=tag:Name,Values=MYTAG' --query 'Reservations[0].Instances[0].NetworkInterfaces[0].Association.PublicIp' --output text); ssh ${host}"

I honestly don't know how the ProxyCommand option works and neither man ssh or man ssh_config seems to do a good job explaining it.

can this be achieved?

Answer 1

ProxyCommand acts as an alternative for the raw TCP connection. It doesn't replace the whole SSH connection – although you often see it used to invoke ssh -W, but that's still just using another SSH system to provide a raw TCP tunnel.

So in your situation, the ProxyCommand should run some simple "TCP pipe" app such as nc or socat or ncat – anything which attaches stdin/stdout to a TCP connection will do:

Host ...
    ProxyCommand bash -c "host=...; nc $host %p"

Host ...
    ProxyCommand bash -c "host=...; socat STDIO TCP:$host:%p"

I would really recommend moving all the complex stuff out of your ~/.ssh/config into a separate script, so that your configuration could just look like this:

Host ...
    ProxyCommand ~/bin/ec2-connect %h %p