Skip to content

README.md

Latest commit

 

History

History
54 lines (39 loc) · 1.97 KB

README.md

File metadata and controls

54 lines (39 loc) · 1.97 KB

aws-ec2-autoscaling-relay-to-private-subnet

ℹ️ This example is intended for users that have a AWS NAT Gateway that they need to route Internet-bound traffic through. A use case for this is if you have static IP addresses (typically Elastic IPs) that need to use for Internet-bound traffic such as restricting access to GitHub or Snowflake to a custom allow-list of IP addrresses. AWS NAT Gateway is a Hard NAT which forces DERP connections. This example deploys a Peer Relay to a Public Subnet to relay traffic to an App Connector in a Private Subnet.

diagram for aws-ec2-autoscaling-relay-to-private-subnet

This module creates the following:

  • a VPC and related resources including a NAT Gateway, a public subnet, and a private subnet
  • an EC2 Launch Template and Autoscaling Group for a Tailscale Peer Relay in the public subnet
  • an EC2 Launch Template and Autoscaling Group for a Tailscale App Connector in the private subnet

Policy File Example

{
    "grants": [
		//////////////
		// Peer relays
		//////////////
		{
			"src": ["tag:example-infra"],
			"dst": ["tag:example-relay"],
			"app": {
				"tailscale.com/cap/relay": [],
			},
		},
    ]
}

Considerations

  • Any advertised routes for the App Connector must still be approved in the Tailscale Admin Console. The code can be updated to use Auto Approvers for routes if this is configured in your ACLs.

To use

Follow the documentation to configure the Terraform providers:

Deploy

terraform init
terraform apply

To destroy

terraform destroy