1.0.1

Bumps clouddrove/cloudwatch-event-rule/aws to 1.0.3, which fixes the Repository tag on the Session Manager audit event rule.

1.0.2 of that module declared a repository variable, validated it, and never passed it to its labels call, so the rule was tagged Repository = https://github.com/clouddrove/terraform-aws-labels regardless of what this module passed down.

Resource-level tags take precedence over the provider's default_tags, so the wrong value silently replaced a correct account-wide Repository tag, with no plan diff because the value was constant rather than drifting.

Also strips trailing whitespace and adds missing end-of-file newlines in four workflow files and commitlint.config.cjs. These were pre-existing pre-commit violations that failed the gate on any PR touching the repo, including PRs that never went near those files.

1.0.0

First tagged release of the SSM-only bastion module.

Pin it with:

source = "git::https://github.com/clouddrove/terraform-aws-bastion.git?ref=1.0.0"

What it does

An EC2 bastion reachable only through AWS Systems Manager Session Manager: no SSH key, no public IP, no inbound security group rules. A companion client in client/ opens SSM port forwarding tunnels through a local HAProxy, so private endpoints answer on their real hostnames with TLS intact.

Session logging

Every Session Manager connection is recorded in CloudWatch Logs at 7 day retention, with a dashboard over it. A CloudTrail trail logging management events must exist in the region, since Session Manager publishes no native EventBridge event. Shell transcripts are opt-in, because they require SSM-SessionManagerRunShell, an account and region singleton.

See docs/session-logging.md.

Client

One entry point for every backing service: EKS, internal ALBs, Aurora, RDS Proxy, RDS PostgreSQL and MySQL, ElastiCache Redis and memcached, DocumentDB, OpenSearch including Dashboards, MSK, plus custom[] for anything else reachable from the bastion. See docs/client.md.

Known limitations

• MSK forwards only the first bootstrap broker
• DocumentDB needs directConnection=true
• MySQL is a direct local port, so strict hostname verification will not match
• Discovery is first-match-by-substring on the environment name
• The newer client services are verified by syntax and by discovery queries running cleanly against a live account, not by tunnelling to real instances