Bug-Byte 4: Systems Manager Node Password Reset Failing

I encountered this issue while attempting to reset the password of a user on a Windows server 2016 managed node using AWS Systems Manager. In the console, I could start the workflow and enter a replacement password. However, I was not prompted to confirm the change.

Unfortunately, that meant I could no longer access the EC2 Instance. On top of that, I couldn’t RDP to the target instance with the new password. Thankfully, I could work around this console bug using the AWS CLI.

First, I had to install the Session Manager plugin for the AWS CLI, which was easy enough. I then attempted to run the following command from the documentation

    
        
aws ssm start-session \
    --target instance-id \
    --document-name "AWS-PasswordReset" \
    --parameters '{"username": ["user-name"]}'
    

That resulted in an MFA error for me, because I was using a role to access the target account.

Unfortunately, Session Manager does not play well with MFA tokens, so I needed a token manager like awsume. Once I installed and used awsume to manage my token, I successfully ran the command, connected to the target instance, and updated the password with confirmation.

Hope that helped. Good luck out there in the cloud.

Document Reference:

• AWSume for CLI Credential management
• Session Manager Plugin for the AWS CLI
• Replacing passwords on managed nodes documentation