Instance (AWS)

AWS Instance with multiple SSH Key support.

Usage

ssh-keygen -t rsa

module "bastion" {
  source = "github.com/opszero/terraform-aws-bastion"

  ssh_keys = [ "ssh-rsa ..." ]
  
  users = {
    "username" = {
      ssh-keys = [
         "ssh-rs ..."
      ]
    }
  }
}

Connect

• Use MrMgr to setup IAM access to the Bastion
• pip3 install pip3 install ec2instanceconnectcli
• mssh --profile awsprofile ubuntu@i-1234566

Deployment

terraform init
terraform plan
terraform apply -auto-approve

Teardown

terraform destroy -auto-approve

Providers

Name	Version
aws	n/a
cloudinit	n/a

Inputs

Name	Description	Type	Default	Required
ami_id	The AMI ID of the bastion host	string	null	no
efs_mounts	EFS multiple mounts	map	{}	no
ingress_cidrs	Configuration block for ingress rules	any	n/a	yes
instance_profile	n/a	object({ role_name = string assume_role_service = string policy_arns = list(string) })	null	no
instance_type	EC2 Instance Type of the bastion host	string	"t3.micro"	no
name	The name of the bastion host	string	n/a	yes
security_group_ids	A list of security group names to associate with.	list(any)	[]	no
ssh_keys	SSH public keys to add to the image	list(any)	[]	no
subnet_id	The VPC subnet ID to launch in EC2 bastion host	string	n/a	yes
tags	A map of tags to assign to the resource	map(any)	{}	no
ubuntu_version	Ubuntu Server Version	string	"24.04"	no
user_data	User data to provide when launching the instance	string	""	no
user_data_replace_on_change	To recreate the instance when user_data is changed	bool	false	no
userdata	User data to provide when launching the instance	string	""	no
users	Custom user accounts of the instance	map	{ "retool": { "ssh-keys": [] } }	no
volume_size	Size of the volume in gibibytes (GiB)	number	20	no
vpc_id	The VPC ID to create security group for bastion host	string	n/a	yes

Resources

Name	Type
aws_cloudwatch_metric_alarm.aws_bastion_cpu_threshold	resource
aws_eip.this	resource
aws_iam_instance_profile.this	resource
aws_iam_role.this	resource
aws_iam_role_policy_attachment.this	resource
aws_instance.this	resource
aws_security_group.this	resource
aws_security_group_rule.this	resource
aws_ssm_parameter.ubuntu	data source
cloudinit_config.config	data source

Outputs

Name	Description
instance_id	n/a
public_ip	n/a

🚀 Built by opsZero!

opsZero provides software and consulting for Cloud + AI. With our decade plus of experience scaling some of the world’s most innovative companies we have developed deep expertise in Kubernetes, DevOps, FinOps, and Compliance.

Our software and consulting solutions enable organizations to:

• migrate workloads to the Cloud
• setup compliance frameworks including SOC2, HIPAA, PCI-DSS, ITAR, FedRamp, CMMC, and more.
• FinOps solutions to reduce the cost of running Cloud workloads
• Kubernetes optimized for web scale and AI workloads
• finding underutilized Cloud resources
• setting up custom AI training and delivery
• building data integrations and scrapers
• modernizing onto modern ARM based processors

We do this with a high-touch support model where you:

• Get access to us on Slack, Microsoft Teams or Email
• Get 24/7 coverage of your infrastructure
• Get an accelerated migration to Kubernetes

Please schedule a call if you need support.