Banyan Google Cloud Access Tier Module

Creates an autoscaling Access Tier for use with Banyan Security.

This module creates an autoscaler and a TCP load balancer in Google Cloud (GCP) for a Banyan Access Tier. Only the load balancer is exposed to the public internet. The Access Tier and your applications live in private subnets with no ingress from the internet.

Usage

provider "google" {
  project = "my-gcloud-project"
  region  = "us-west1"
}

module "gcp_accesstier" {
  name                     = "my-accesstier"
  project                  = "my-project"
  region                   = "us-west1"
  network                  = "my-network"
  subnetwork               = "my-subnet"
  cluster_name             = "us-west1"
  site_name                = "my-banyan-site"
  site_domain_names        = ["*.bnndemos.com"]
  minimum_num_of_instances = 2
  refresh_token            = var.refresh_token
}

Notes

It's probably also a good idea to leave the refresh_token out of your code and pass it as a variable instead, so you don't accidentally commit your Banyan API token to your version control system:

variable "refresh_token" {
  type = string
}

module "gcp_accesstier" {
  source                 = "banyansecurity/banyan-accesstier/google"
  refresh_token          = var.refresh_token
  ...
}

export TF_VAR_refresh_token="eyJhbGciOiJSUzI1NiIsIm..."
terraform plan

Inputs

Name	Description	Type	Default	Required
api_server	URL to the Banyan API server	`string`	`"https://net.banyanops.com/api/v1"`	no
at_version	version specified to install if left blank, latest will be installed	`string`	`""`	no
cluster_name	Name of an existing Shield cluster to register this AccessTier with	`string`	n/a	yes
deb_repo	the repo holding the netagent binaries	`string`	`"www.banyanops.com"`	no
machine_type	Google compute instance types	`string`	`"e2-standard-4"`	no
minimum_num_of_instances	The minimum number of instances that should be running	`number`	`2`	no
name	Name of the environment being protected. All resources will be prefixed with this name	`string`	n/a	yes
network	Name of the network the AccessTier will belong to	`string`	n/a	yes
project	GCloud project name where AccessTier is deployed	`string`	n/a	yes
redirect_http_to_https	If true, requests to the AccessTier on port 80 will be redirected to port 443	`bool`	`false`	no
refresh_token	API token generated from the Banyan console	`string`	n/a	yes
region	Region in which to create the Accestier	`string`	n/a	yes
site_domain_names	List of aliases or CNAMEs that will direct traffic to this AccessTier	`list(string)`	n/a	yes
site_name	Name to use when registering this AccessTier with the console	`string`	n/a	yes
subnetwork	Name of the subnetwork the AccessTier will belong to	`string`	n/a	yes

Outputs

Name	Description
lb_ip_address	External IP address of the load balancer

To Do

Add support for access event rate-limiting paramters
Adjust kernel tunables according to Banyan best-practice docs

Authors

Module created and managed by Todd Radel.

License

Licensed under Apache 2. See LICENSE for details.

Needs cloudNAT setup on the network used so instances can talk outside of their network

banyansecurity/terraform-google-banyan-accesstier