SSH into AWS EC2 instances from your Mac

EC2 instances come in two shapes: public ones you reach directly with the key pair AWS gave you, and private ones in a VPC subnet that only a bastion or a VPN can reach. Behind them there is often an RDS database that answers only inside the VPC. With the OpenSSH client, that becomes ssh -i ~/keys/app.pem -J ec2-user@bastion ec2-user@10.0.1.42 typed from memory. In SSHive each machine is a profile: the bastion once, each private instance pointing at it, and the database tunnel on the bastion's profile. When the bastion's address changes, you edit one profile.

AWS hands you a .pem file when you create a key pair. The cleanest way to use it in SSHive is to import it once: open Settings > SSH Keys > Import a key and paste the file's content. SSHive then keeps the key encrypted, and the profile no longer depends on a file sitting in Downloads. Create a profile with the instance's public DNS name or IP and the user of its AMI: ec2-user on Amazon Linux, ubuntu on Ubuntu, admin on Debian. The instance's security group must allow port 22 from your address.

Application servers belong in private subnets, reached through a bastion in the public subnet. Create the bastion's profile first (public address, user, key). In the profile of a private instance, enter its private IP, then open Advanced options > Jump Chain (multi-hop), choose Add hop and pick the bastion. SSHive connects to the bastion first and opens the session to the instance through it. Each hop signs in with its own profile, so the bastion and the instance can use different keys. A chain holds up to five hops, and it is a Pro feature. The jump host guide goes through it screen by screen.

RDS sits in a private subnet, and your database client on the Mac cannot reach it. The bastion can. On the bastion's profile, add a local tunnel: local port 5432, remote host mydb.xxxxxxxx.eu-west-1.rds.amazonaws.com, remote port 5432. Connect to the bastion, then point TablePlus or DBeaver at localhost:5432 with the database credentials. The name is resolved on the bastion, inside the VPC, which is why it works. This part fits in the free version: it is a single local tunnel on a direct connection.