ecs-bastion

Creates a service on ECS that has ssh open to enable tunneling.

Usage

  module "ecs-bastion" {
    source            = "git::ssh://[email protected]/miquido/terraform/ecs-bastion.git?ref=1.1.23"
    aws_region        = var.aws_region
    ecs_cluster_arn   = aws_ecs_cluster.main.arn
    environment       = var.environment
    project           = var.project
    public_ssh_keys   = <<EOT
                        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBoJKBh1ECj1RGt/fgiQz/DvLwW9NzDmR3RAhB5Rb1BM test
                        ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/5jNq77nbp5FoRnK7lHHdHhCFa8jdJ8QzLF/M3b7nt0ansRwxgsMJMUAiHNdYvoR3UwmOgtUQzBasKfbML8hK/f0crSE0sh/cXvYBC+3jWN0sT3zW307w4po9KS+RJpP8mEu0vYh3Ua4+O06ePuagD5JfSNLJ8d6xi2QCY87cKENjs4ysupwN/+/VH5nWHerVrFKQ4oW/ARYHGfaL4N1npvSK9m2nnDy1uX+ti3GGys9/2GMW0wPbjrI+Z1sc252QdgxNGn/zT7lKWCn+00mAcov8wkclwTl3RQFSW2ni/3saFyBUi/9CiRvKtjLCdxks3+K2tTdHNUaAajlR7UfB [email protected]
    EOT
    public_subnet_ids = module.vpc.public_subnet_ids
    route53_zone_id   = aws_route53_zone.default.id
    security_groups   = [module.vpc.vpc_default_security_group_id]
    vpc_id            = module.vpc.vpc_id
    web_domain        = "bastion.${local.app_web_domain}"
    whitelist_ips = [
      {
        description = "ip Marka",
        cidr        = "178.43.248.169/32",
      }
    ]
    tags              = var.tags
  }

Makefile Targets

Available targets:

  help                                Help screen
  help/all                            Display help for all targets
  help/short                          This help short screen
  lint                                Lint terraform code

Requirements

Name	Version
terraform	>= 0.13
aws	>= 4.7

Providers

Name	Version
archive	n/a
aws	>= 4.7

Modules

Name	Source	Version
bastion_pubkeys	cloudposse/s3-bucket/aws	4.7.0
ecs-bastion-task-definition	git::https://github.com/cloudposse/terraform-aws-ecs-container-definition.git	0.61.1
ecs_alb_service_task	git::https://github.com/cloudposse/terraform-aws-ecs-alb-service-task.git	v0.76.0

Resources

Name	Type
aws_cloudwatch_log_group.app	resource
aws_cloudwatch_log_group.pubkeys_changed_notification	resource
aws_iam_role.pubkeys_changed_notification	resource
aws_iam_role_policy.bastion_policy	resource
aws_iam_role_policy.pubkeys_changed_notification	resource
aws_lambda_function.pubkeys_changed_notification	resource
aws_lambda_permission.s3-event-allow_bucket	resource
aws_s3_bucket_notification.bucket_notification	resource
aws_s3_object.object	resource
aws_security_group.ssh	resource
archive_file.pubkeys_changed_notification	data source
aws_caller_identity.current	data source
aws_iam_policy_document.assume_role_pubkeys_changed_notification	data source
aws_iam_policy_document.bastion_policy	data source
aws_iam_policy_document.role_pubkeys_changed_notification	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
auto_deploy_new_task_versions	Set to true if there should be auto deploy of new task versions	bool	false	no
aws_region	n/a	string	n/a	yes
container_image	docker image of bastion	string	"miquidocompany/aws-ecs-bastion:3546346774-7c1491b5"	no
ecs_cluster_arn	ECS Cluster arn	string	n/a	yes
environment	Environment name	string	n/a	yes
ignore_changes_desired_count	If yes than terraform will not try to update current desired count of the task	bool	true	no
log_retention	How long should logs be retained	number	7	no
project	Account/Project Name	string	n/a	yes
public_ssh_keys	rsa.pub strings	string	n/a	yes
public_subnet_ids	Public subnets ids	list(string)	n/a	yes
restart_on_ssh_keys_change	Restart bastion ecs task when ssh keys are changed	bool	true	no
route53_zone_id	Route 53 Zone id for bastion entry	string	""	no
security_groups	Security groups	list(string)	n/a	yes
tags	Default tags to apply on all created resources	map(string)	{}	no
use_spot	Set if task should run on Fargate SPOT	bool	true	no
vpc_id	vpc id	string	n/a	yes
web_domain	domain under which bastion will be available	string	""	no
whitelist_ips	List of ip addresses that will be allowed to connect on port 22	list(object({ description = string, cidr = string }))	n/a	yes

Outputs

No outputs.

Related Projects

Check out these related projects.

License

The MIT License (MIT)

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Source: <https://opensource.org/licenses/MIT>