This module will generate a bastion host vm compatible with OS Login and IAP Tunneling that can be used to access internal VMs.
This module will:
- Create a dedicated service account for the bastion host
- Create a GCE instance to be the bastion host
- Create a firewall rule to allow TCP:22 SSH access from the IAP to the bastion
- Necessary IAM bindings to allow IAP and OS Logins from specified members
Basic usage of this module is as follows:
module "iap_bastion" {
source = "terraform-google-modules/bastion-host/google"
version = 0.1.0
project = var.project
region = var.region
zone = var.zone
network = google_compute_network.net.self_link
subnet = google_compute_subnetwork.net.self_link
members = [
"group:[email protected]",
"user:[email protected]",
]
}
Functional example is included in the examples directory.
These sections describe requirements for using this module.
The following dependencies must be available:
A project with the following APIs enabled must be used to host the resources of this module:
- Google Cloud Storage JSON API:
storage-api.googleapis.com
- Compute Engine API:
compute.googleapis.com
- Cloud Identity-Aware Proxy API:
iap.googleapis.com
- OS Login API:
oslogin.googleapis.com
The Project Factory module can be used to provision a project with the necessary APIs enabled.
Name | Description | Type | Default | Required |
---|---|---|---|---|
host_project | The network host project ID | string | "" |
no |
image_family | Source image family for the Bastion. | string | "centos-7" |
no |
image_project | Project where the source image for the Bastion comes from | string | "gce-uefi-images" |
no |
labels | Key-value map of labels to assign to the bastion host | map | <map> |
no |
machine_type | Instance type for the Bastion host | string | "n1-standard-1" |
no |
members | List of IAM resources to allow access to the bastion host | list(string) | <list> |
no |
name | Name of the Bastion instance | string | "bastion-vm" |
no |
network | Self link for the network on which the Bastion should live | string | n/a | yes |
project | The project ID to deploy to | string | n/a | yes |
random_role_id | Enables role random id generation. | bool | "true" |
no |
region | The primary region where the bastion host will live | string | "us-central1" |
no |
scopes | List of scopes to attach to the bastion host | list | <list> |
no |
service_account_roles | List of IAM roles to assign to the service account. | list | <list> |
no |
service_account_roles_supplemental | An additional list of roles to assign to the bastion if desired | list | <list> |
no |
shielded_vm | Enable shielded VM on the bastion host (recommended) | string | "true" |
no |
startup_script | Render a startup script with a template. | string | "" |
no |
subnet | Self link for the subnet on which the Bastion should live. Can be private when using IAP | string | n/a | yes |
tags | Network tags, provided as a list | list(string) | <list> |
no |
zone | The primary zone where the bastion host will live | string | "us-central1-a" |
no |
Name | Description |
---|---|
hostname | Host name of the bastion |
ip_address | Internal IP address of the bastion host |
self_link | Self link of the bastion host |
service_account | The email for the service account created for the bastion host |
Refer to the contribution guidelines for information on contributing to this module.