terraform-aws-ssm-bastion

Terraform module to provision an Bastion host.

It's 100% Open Source and licensed under the APACHE2.

Introduction

For Bastions, store SSH key in SSM.

Usage

Include this repository as a module in your existing terraform code:

module "ssm-bastion" {
  source            = "JamesWoolfenden/ssm-bastion/aws"
  version           = "0.1.11"
  allowed_cidrs     = [ "${chomp(data.http.myip.body)}/32" ]
  vpc_id            = element(data.aws_vpcs.vpc.ids, 0)
  instance_type     = var.instance_type
  ssm_standard_role = var.ssm_standard_role
  subnet_id         = element(data.aws_subnet_ids.subnets.ids, 0)
  environment       = var.environment
  name              = var.name
}

Cost

Monthly cost estimate

Project: JamesWoolfenden/terraform-aws-ssm-bastion/example/examplea

 Name                                                Monthly Qty  Unit     Monthly Cost

 module.bastion.aws_instance.bastion
 ├─ Instance usage (Linux/UNIX, reserved, t2.micro)          730  hours           $0.00
 ├─ EC2 detailed monitoring                                    7  metrics         $2.10
 └─ root_block_device
    └─ Storage (general purpose SSD, gp2)                      8  GB              $0.93

 OVERALL TOTAL                                                                    $3.03

Requirements

No requirements.

Providers

Name	Version
aws	n/a
local	n/a
tls	n/a

Modules

No modules.

Resources

Name	Type
aws_iam_instance_profile.bastion	resource
aws_iam_role.ssm_role	resource
aws_iam_role_policy_attachment.ssm_standard	resource
aws_instance.bastion	resource
aws_key_pair.ssm_key	resource
aws_security_group.instance_ssh_access	resource
local_file.private_ssh	resource
local_file.public_ssh	resource
tls_private_key.ssh	resource
aws_ami.ubuntu	data source
aws_iam_policy_document.assume	data source

Inputs

Name	Description	Type	Default	Required
allowed_cidrs	n/a	`list(any)`	n/a	yes
environment	The environment name	`string`	n/a	yes
instance_type	n/a	`string`	n/a	yes
name	Name of the bastion host	`string`	n/a	yes
ssm_standard_role	n/a	`string`	n/a	yes
subnet_id	n/a	`string`	n/a	yes
vpc_id	n/a	`string`	n/a	yes

Outputs

Name	Description
bastion	n/a
client_public_ip	Bastion public IP

Policy

This is the policy required to build this project:

The Terraform resource required is:

resource "aws_iam_policy" "terraform_pike" {
  name_prefix = "terraform_pike"
  path        = "/"
  description = "Pike Autogenerated policy from IAC"

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateKeyPair",
                "ec2:CreateSecurityGroup",
                "ec2:DeleteKeyPair",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstanceCreditSpecifications",
                "ec2:DescribeInstanceTypes",
                "ec2:DescribeInstances",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:ImportKeyPair",
                "ec2:ModifyInstanceAttribute",
                "ec2:MonitorInstances",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:UnmonitorInstances"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "iam:AddRoleToInstanceProfile",
                "iam:AttachRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteInstanceProfile",
                "iam:DeleteRole",
                "iam:DetachRolePolicy",
                "iam:GetInstanceProfile",
                "iam:GetRole",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListRolePolicies",
                "iam:PassRole",
                "iam:RemoveRoleFromInstanceProfile"
            ],
            "Resource": "*"
        }
    ]
})
}

Help

Got a question?

File a GitHub issue.

Contributing

Bug Reports & Feature Requests

Please use the issue tracker to report any bugs or file feature requests.

Copyrights

License

See LICENSE for full details.

Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Contributors

James Woolfenden

Jukka Keski-Luopa

fylfot/terraform-aws-ssm-bastion