Skip to content

1.0.0

Choose a tag to compare

View all tags
@clouddrove-ci clouddrove-ci released this 06 Aug 20:34
· 6 commits to master since this release
1.0.0
c463c4e

First tagged release of the SSM-only bastion module.

Pin it with:

source = "git::https://github.com/clouddrove/terraform-aws-bastion.git?ref=1.0.0"

What it does

An EC2 bastion reachable only through AWS Systems Manager Session Manager: no SSH key, no public IP, no inbound security group rules. A companion client in client/ opens SSM port forwarding tunnels through a local HAProxy, so private endpoints answer on their real hostnames with TLS intact.

Session logging

Every Session Manager connection is recorded in CloudWatch Logs at 7 day retention, with a dashboard over it. A CloudTrail trail logging management events must exist in the region, since Session Manager publishes no native EventBridge event. Shell transcripts are opt-in, because they require SSM-SessionManagerRunShell, an account and region singleton.

See docs/session-logging.md.

Client

One entry point for every backing service: EKS, internal ALBs, Aurora, RDS Proxy, RDS PostgreSQL and MySQL, ElastiCache Redis and memcached, DocumentDB, OpenSearch including Dashboards, MSK, plus custom[] for anything else reachable from the bastion. See docs/client.md.

Known limitations

  • MSK forwards only the first bootstrap broker
  • DocumentDB needs directConnection=true
  • MySQL is a direct local port, so strict hostname verification will not match
  • Discovery is first-match-by-substring on the environment name
  • The newer client services are verified by syntax and by discovery queries running cleanly against a live account, not by tunnelling to real instances
Assets 2
Loading