default-infra/bastion.tf at develop · tetsuuu/default-infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
resource "aws_instance" "bastion" {
  ami                         = "${var.ec2_ami}"
  ebs_optimized               = false
  instance_type               = "t3.micro"
  monitoring                  = false
  key_name                    = "${var.common_key}"
  subnet_id                   = "${aws_subnet.public.0.id}"
  vpc_security_group_ids      = ["${aws_security_group.bastion-ingress.id}"]
  associate_public_ip_address = true
  source_dest_check           = true
  iam_instance_profile        = "bastion"
  disable_api_termination     = false

  user_data                   = "${file("userdata/bastion-${var.environment}.sh")}"

  root_block_device {
    volume_type           = "gp2"
    volume_size           = "${var.bastion_root_block_device_volume_size}"
    delete_on_termination = "${var.bastion_root_block_device_delete_on_termination}"
  }

  tags {
    "Service" = "default"
    "Name" = "${var.region}-bastion"
  }

  lifecycle {
    ignore_changes = [
      "user_data",
      "ami",
      "instance_type",
      "key_name",
      "root_block_device.0.volume_type",
      "subnet_id",
      "vpc_security_group_ids",
      "ebs_optimized"
    ]
  }
}

resource "aws_security_group" "bastion-ingress" {
    name        = "bastion-ingress"
    description = "Bastion Security Group"
    vpc_id      = "${aws_vpc.default-vpc.id}"

    ingress {
        from_port       = 22
        to_port         = 22
        protocol        = "tcp"
        cidr_blocks     = [
          //TODO
          "0.0.0.0/32"
        ]
    }

    egress {
        from_port       = 0
        to_port         = 0
        protocol        = "-1"
        cidr_blocks     = ["0.0.0.0/0"]
    }

    tags {
        "Name" = "bastion-ingress"
        "Service" = "default"
    }
}