From 12f933718185bbf0e01c94083f1f9f52b2c482c8 Mon Sep 17 00:00:00 2001 From: Daniel Cohen Date: Fri, 13 Feb 2026 09:23:07 +1100 Subject: [PATCH] Allow configuring the local host for port forwarrding sessions The port forwarding host is hardcoded to be localhost. This prevents us from connecting to it directly from docker using host.docker.internal. Allow configuring the local host name using `SSM_PLUGIN_LOCAL_HOST`. Example: ```sh export SSM_PLUGIN_LOCAL_HOST="0.0.0.0" aws ssm start-session \ --region ap-southeast-2 \ --target [BASTION_EC2_INSTANCE_ID] \ --document-name AWS-StartPortForwardingSessionToRemoteHost \ --parameters host="[RDS_PG_ENDPOINT]",portNumber="5432",localPortNumber="2222" ``` Test: ```sh docker run -it --rm \ --add-host "host.docker.internal:host-gateway" \ -e "PGPASSWORD" \ postgres:16.3 psql -h host.docker.internal -p 2222 -U [DB_USER] -d [DB_NAME] ``` https://github.com/aws/session-manager-plugin/issues/14#issuecomment-1479293135 --- .../session/portsession/basicportforwarding.go | 9 ++++++++- .../session/portsession/muxportforwarding.go | 9 ++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/src/sessionmanagerplugin/session/portsession/basicportforwarding.go b/src/sessionmanagerplugin/session/portsession/basicportforwarding.go index 65f1057c8..58d16f0ee 100644 --- a/src/sessionmanagerplugin/session/portsession/basicportforwarding.go +++ b/src/sessionmanagerplugin/session/portsession/basicportforwarding.go @@ -142,6 +142,7 @@ func (p *BasicPortForwarding) startLocalConn(log log.T) (err error) { // startLocalListener starts a local listener to given address func (p *BasicPortForwarding) startLocalListener(log log.T, portNumber string) (listener net.Listener, err error) { + var displayMessage string switch p.portParameters.LocalConnectionType { case "unix": @@ -150,7 +151,13 @@ func (p *BasicPortForwarding) startLocalListener(log log.T, portNumber string) ( } displayMessage = fmt.Sprintf("Unix socket %s opened for sessionId %s.", p.portParameters.LocalUnixSocket, p.sessionId) default: - if listener, err = getNewListener("tcp", "localhost:"+portNumber); err != nil { + listenerHost := os.Getenv("SSM_PLUGIN_LOCAL_HOST") + if listenerHost == "" { + listenerHost = "localhost" + } + listenerAddress := net.JoinHostPort(listenerHost, portNumber) + + if listener, err = getNewListener("tcp", listenerAddress); err != nil { return } // get port number the TCP listener opened diff --git a/src/sessionmanagerplugin/session/portsession/muxportforwarding.go b/src/sessionmanagerplugin/session/portsession/muxportforwarding.go index 45801ce1e..62db3dc32 100644 --- a/src/sessionmanagerplugin/session/portsession/muxportforwarding.go +++ b/src/sessionmanagerplugin/session/portsession/muxportforwarding.go @@ -242,7 +242,14 @@ func (p *MuxPortForwarding) handleClientConnections(log log.T, ctx context.Conte if p.portParameters.LocalPortNumber == "" { localPortNumber = "0" } - if listener, err = net.Listen("tcp", "localhost:"+localPortNumber); err != nil { + + listenerHost := os.Getenv("SSM_PLUGIN_LOCAL_HOST") + if listenerHost == "" { + listenerHost = "localhost" + } + listenerAddress := net.JoinHostPort(listenerHost, localPortNumber) + + if listener, err = net.Listen("tcp", listenerAddress); err != nil { return err } p.portParameters.LocalPortNumber = strconv.Itoa(listener.Addr().(*net.TCPAddr).Port)