AWS Bastion SSM IAM

Terraform module which provides a Bastion for AWS utilizing

• Autoscaling group of min/max 1 for resiliency
• AWS SSM Session Manager, this allows users to start a Terminal Session or Tunnel to an instance without the need of public internet access
• ec2-instance-connect, for the creation of temporary ssh keys on the instance

NOTE Important, this module managed the SSM Document SSM-SessionManagerRunShell, in some cases it already exists. To make sure Terraform is used to maintain this Document please execute: aws ssm delete-document --name SSM-SessionManagerRunShell. In case you do not want to overwrite SSM-SessionManagerRunShell, you can use the module directive create_new_ssm_document to create a different document name. This document needs to be refered to as follows: SSM_DOCUMENT_NAME="SSM-SessionManagerRunShell-JKURx" ./ssh_terminal

NOTE For this to work you need to install the session manager plugin for the AWSCLI, click (here)[https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html] for more information.

Examples

Check the examples directory for installation.

Client

SSH Terminal

The bash script client/ssh_terminal provides a simplified way to ssh to the IAM Bastion, it uses a recent awscli-client with ssm terminal support.

SSH Tunnel

The bash script client/ssh_tunnel creates an SSH tunnel using the BASTION, it uses a recent awscli-client with ssm terminal support and ec2-instance-connect for uploading the SSH Public key to AWS. Make sure the BASTION has access to the resources it needs access to by modifying the Security Group of the resouce.

By default the public key file $HOME/.ssh/id_rsa.pub will be used for temporary access. The ENVIRONMENT variable SSH_PUB_KEY_FILE can be used to set a different public key, as of now AWS does not support ed25519 public keys. By default the ENVIRONMENT variable AWS_REGION will be used for the awscli-tool, if you are using awscli profiles, please provide the correct region by setting the AWS_REGION-variable. If DEV_LOCAL_PORT is specified, the ssh tunnel will be created with DEV_LOCAL_PORT as local port to connect to, if not a RANDOM port will be used.

Example:

./ssh_tunnel private_subnet.isdfjsdf.eu-central-1.rds.amazonaws.com:3306

Requirements

Providers

Modules

No modules.

Resources

Inputs

list(object({
    key                 = string
    value               = string
    propagate_at_launch = bool
  }))

Outputs

License

MIT

Copyright (c) 2021 Flaconi GmbH