|
| 1 | +# Component: `bastion` |
| 2 | + |
| 3 | +This component is responsible for provisioning a generic Bastion host with parameterized `user_data` and support for AWS SSM Session Manager for remote access with IAM authentication. |
| 4 | + |
| 5 | +## Usage |
| 6 | + |
| 7 | +**Stack Level**: Regional |
| 8 | + |
| 9 | +Here's an example snippet for how to use this component. |
| 10 | + |
| 11 | +```yaml |
| 12 | +components: |
| 13 | + terraform: |
| 14 | + bastion: |
| 15 | + vars: |
| 16 | + associate_public_ip_address: true |
| 17 | + custom_bastion_hostname: bastion |
| 18 | + vanity_domain: example.com |
| 19 | + security_group_rules: |
| 20 | + - type : "ingress" |
| 21 | + from_port : 22 |
| 22 | + to_port : 22 |
| 23 | + protocol : tcp |
| 24 | + cidr_blocks : ["1.2.3.4/32"] |
| 25 | + - type : "egress" |
| 26 | + from_port : 0 |
| 27 | + to_port : 0 |
| 28 | + protocol : -1 |
| 29 | + cidr_blocks : ["0.0.0.0/0"] |
| 30 | +``` |
| 31 | +
|
| 32 | +<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
| 33 | +## Requirements |
| 34 | +
|
| 35 | +| Name | Version | |
| 36 | +|------|---------| |
| 37 | +| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 | |
| 38 | +| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.0 | |
| 39 | +| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 | |
| 40 | +| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.0 | |
| 41 | +| <a name="requirement_template"></a> [template](#requirement\_template) | >= 2.2 | |
| 42 | +
|
| 43 | +## Providers |
| 44 | +
|
| 45 | +| Name | Version | |
| 46 | +|------|---------| |
| 47 | +| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.0 | |
| 48 | +| <a name="provider_cloudinit"></a> [cloudinit](#provider\_cloudinit) | n/a | |
| 49 | +
|
| 50 | +## Modules |
| 51 | +
|
| 52 | +| Name | Source | Version | |
| 53 | +|------|--------|---------| |
| 54 | +| <a name="module_aws_key_pair"></a> [aws\_key\_pair](#module\_aws\_key\_pair) | cloudposse/key-pair/aws | 0.18.0 | |
| 55 | +| <a name="module_ec2_bastion"></a> [ec2\_bastion](#module\_ec2\_bastion) | cloudposse/ec2-bastion-server/aws | 0.28.0 | |
| 56 | +| <a name="module_iam_roles"></a> [iam\_roles](#module\_iam\_roles) | ../account-map/modules/iam-roles | n/a | |
| 57 | +| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.24.1 | |
| 58 | +| <a name="module_vpc"></a> [vpc](#module\_vpc) | cloudposse/stack-config/yaml//modules/remote-state | 0.17.0 | |
| 59 | +
|
| 60 | +## Resources |
| 61 | +
|
| 62 | +| Name | Type | |
| 63 | +|------|------| |
| 64 | +| [aws_ebs_volume.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume) | resource | |
| 65 | +| [aws_eip.static](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource | |
| 66 | +| [aws_eip_association.static](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip_association) | resource | |
| 67 | +| [aws_iam_instance_profile.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource | |
| 68 | +| [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | |
| 69 | +| [aws_iam_role_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | |
| 70 | +| [aws_route53_record.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | |
| 71 | +| [aws_ssm_parameter.ssh_private_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | |
| 72 | +| [aws_volume_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/volume_attachment) | resource | |
| 73 | +| [aws_iam_policy_document.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | |
| 74 | +| [aws_iam_policy_document.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | |
| 75 | +| [aws_route53_zone.vanity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source | |
| 76 | +| [cloudinit_config.config](https://registry.terraform.io/providers/hashicorp/cloudinit/latest/docs/data-sources/config) | data source | |
| 77 | +
|
| 78 | +## Inputs |
| 79 | +
|
| 80 | +| Name | Description | Type | Default | Required | |
| 81 | +|------|-------------|------|---------|:--------:| |
| 82 | +| <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional tags for appending to tags\_as\_list\_of\_maps. Not added to `tags`. | `map(string)` | `{}` | no | |
| 83 | +| <a name="input_associate_public_ip_address"></a> [associate\_public\_ip\_address](#input\_associate\_public\_ip\_address) | Whether to associate public IP to the instance. | `bool` | `false` | no | |
| 84 | +| <a name="input_attributes"></a> [attributes](#input\_attributes) | Additional attributes (e.g. `1`) | `list(string)` | `[]` | no | |
| 85 | +| <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no | |
| 86 | +| <a name="input_custom_bastion_hostname"></a> [custom\_bastion\_hostname](#input\_custom\_bastion\_hostname) | Hostname to assign with bastion instance | `string` | `null` | no | |
| 87 | +| <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | |
| 88 | +| <a name="input_ebs_block_device_volume_size"></a> [ebs\_block\_device\_volume\_size](#input\_ebs\_block\_device\_volume\_size) | The volume size (in GiB) to provision for the EBS block device. Creation skipped if size is 0 | `number` | `0` | no | |
| 89 | +| <a name="input_ebs_delete_on_termination"></a> [ebs\_delete\_on\_termination](#input\_ebs\_delete\_on\_termination) | Whether the EBS volume should be destroyed on instance termination | `bool` | `false` | no | |
| 90 | +| <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | |
| 91 | +| <a name="input_environment"></a> [environment](#input\_environment) | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | |
| 92 | +| <a name="input_generate_ssh_key"></a> [generate\_ssh\_key](#input\_generate\_ssh\_key) | Whether or not to generate an SSH key | `bool` | `true` | no | |
| 93 | +| <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no | |
| 94 | +| <a name="input_image_container"></a> [image\_container](#input\_image\_container) | The image container to use in `container.sh` | `string` | n/a | yes | |
| 95 | +| <a name="input_image_repository"></a> [image\_repository](#input\_image\_repository) | The image repository to use in `container.sh` | `string` | n/a | yes | |
| 96 | +| <a name="input_import_profile_name"></a> [import\_profile\_name](#input\_import\_profile\_name) | IAM Profile to use when importing a resource | `string` | `null` | no | |
| 97 | +| <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | Bastion instance type | `string` | `"t2.micro"` | no | |
| 98 | +| <a name="input_kms_alias_name_ssm"></a> [kms\_alias\_name\_ssm](#input\_kms\_alias\_name\_ssm) | KMS alias name for SSM | `string` | `"alias/aws/ssm"` | no | |
| 99 | +| <a name="input_label_key_case"></a> [label\_key\_case](#input\_label\_key\_case) | The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`.<br>Possible values: `lower`, `title`, `upper`.<br>Default value: `title`. | `string` | `null` | no | |
| 100 | +| <a name="input_label_order"></a> [label\_order](#input\_label\_order) | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no | |
| 101 | +| <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | The letter case of output label values (also used in `tags` and `id`).<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Default value: `lower`. | `string` | `null` | no | |
| 102 | +| <a name="input_name"></a> [name](#input\_name) | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no | |
| 103 | +| <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no | |
| 104 | +| <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | |
| 105 | +| <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes | |
| 106 | +| <a name="input_root_block_device_volume_size"></a> [root\_block\_device\_volume\_size](#input\_root\_block\_device\_volume\_size) | The volume size (in GiB) to provision for the root block device. It cannot be smaller than the AMI it refers to. | `number` | `8` | no | |
| 107 | +| <a name="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules) | A list of maps of Security Group rules.<br>The values of map is fully complated with `aws_security_group_rule` resource.<br>To get more info see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule . | `list(any)` | <pre>[<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "from_port": 0,<br> "protocol": -1,<br> "to_port": 0,<br> "type": "egress"<br> },<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "from_port": 22,<br> "protocol": "tcp",<br> "to_port": 22,<br> "type": "ingress"<br> }<br>]</pre> | no | |
| 108 | +| <a name="input_ssh_key_path"></a> [ssh\_key\_path](#input\_ssh\_key\_path) | Save location for ssh public keys generated by the module | `string` | `"./secrets"` | no | |
| 109 | +| <a name="input_ssh_pub_keys"></a> [ssh\_pub\_keys](#input\_ssh\_pub\_keys) | Enable ssh pub keys from chamber | `bool` | `false` | no | |
| 110 | +| <a name="input_stage"></a> [stage](#input\_stage) | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | |
| 111 | +| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no | |
| 112 | +| <a name="input_user_data"></a> [user\_data](#input\_user\_data) | User data content | `list(string)` | `[]` | no | |
| 113 | +| <a name="input_vanity_domain"></a> [vanity\_domain](#input\_vanity\_domain) | Vanity domain | `string` | `null` | no | |
| 114 | + |
| 115 | +## Outputs |
| 116 | + |
| 117 | +| Name | Description | |
| 118 | +|------|-------------| |
| 119 | +| <a name="output_bastion_fqdn"></a> [bastion\_fqdn](#output\_bastion\_fqdn) | Bastion server custom hostname FQDN | |
| 120 | +| <a name="output_instance_id"></a> [instance\_id](#output\_instance\_id) | Instance ID | |
| 121 | +| <a name="output_private_ip"></a> [private\_ip](#output\_private\_ip) | Private IP of the instance | |
| 122 | +| <a name="output_public_ip"></a> [public\_ip](#output\_public\_ip) | Public IP of the instance (or EIP) | |
| 123 | +| <a name="output_role"></a> [role](#output\_role) | Name of AWS IAM Role associated with the instance | |
| 124 | +| <a name="output_security_group_ids"></a> [security\_group\_ids](#output\_security\_group\_ids) | IDs on the AWS Security Groups associated with the instance | |
| 125 | +<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
| 126 | + |
| 127 | +## References |
| 128 | +* [cloudposse/terraform-aws-components](https://github.com/cloudposse/terraform-aws-components/tree/master/modules/TODO) - Cloud Posse's upstream component |
| 129 | + |
| 130 | +[<img src="https://cloudposse.com/logo-300x69.svg" height="32" align="right"/>](https://cpco.io/component) |
0 commit comments