By quoting the string that ends the "here document", you've disabled subsitution for the variables contained within it. Your $dev_by_path variable is defined on the local side, not in the remotely executing shell. So, you want to expand that before executing the ssh command.
DEVICE=`ssh -i key.pem root@10.0.0.2 'bash -s' <<ENDSSH
basename $(readlink $dev_by_path)
ENDSSH`