terraform-google-bastion-host

This module will generate a bastion host vm compatible with OS Login and IAP Tunneling that can be used to access internal VMs.

This module will:

Create a dedicated service account for the bastion host
Create a GCE instance to be the bastion host
Create a firewall rule to allow TCP:22 SSH access from the IAP to the bastion
Necessary IAM bindings to allow IAP and OS Logins from specified members

Usage

Basic usage of this module is as follows:

module "iap_bastion" {
  source = "terraform-google-modules/bastion-host/google"
  version = 0.1.0

  project = var.project
  region = var.region
  zone = var.zone
  network = google_compute_network.net.self_link
  subnet = google_compute_subnetwork.net.self_link
  members = [
    "group:[email protected]",
    "user:[email protected]",
  ]
}

Functional example is included in the examples directory.

Requirements

These sections describe requirements for using this module.

Software

The following dependencies must be available:

Terraform v0.12
Terraform Provider for GCP

APIs

A project with the following APIs enabled must be used to host the resources of this module:

Google Cloud Storage JSON API: storage-api.googleapis.com
Compute Engine API: compute.googleapis.com
Cloud Identity-Aware Proxy API: iap.googleapis.com
OS Login API: oslogin.googleapis.com

The Project Factory module can be used to provision a project with the necessary APIs enabled.

Inputs

Name	Description	Type	Default	Required
host_project	The network host project ID	string	`""`	no
image_family	Source image family for the Bastion.	string	`"centos-7"`	no
image_project	Project where the source image for the Bastion comes from	string	`"gce-uefi-images"`	no
labels	Key-value map of labels to assign to the bastion host	map	`<map>`	no
machine_type	Instance type for the Bastion host	string	`"n1-standard-1"`	no
members	List of IAM resources to allow access to the bastion host	list(string)	`<list>`	no
name	Name of the Bastion instance	string	`"bastion-vm"`	no
network	Self link for the network on which the Bastion should live	string	n/a	yes
project	The project ID to deploy to	string	n/a	yes
random_role_id	Enables role random id generation.	bool	`"true"`	no
region	The primary region where the bastion host will live	string	`"us-central1"`	no
scopes	List of scopes to attach to the bastion host	list	`<list>`	no
service_account_roles	List of IAM roles to assign to the service account.	list	`<list>`	no
service_account_roles_supplemental	An additional list of roles to assign to the bastion if desired	list	`<list>`	no
shielded_vm	Enable shielded VM on the bastion host (recommended)	string	`"true"`	no
startup_script	Render a startup script with a template.	string	`""`	no
subnet	Self link for the subnet on which the Bastion should live. Can be private when using IAP	string	n/a	yes
tags	Network tags, provided as a list	list(string)	`<list>`	no
zone	The primary zone where the bastion host will live	string	`"us-central1-a"`	no

Outputs

Name	Description
hostname	Host name of the bastion
ip_address	Internal IP address of the bastion host
self_link	Self link of the bastion host
service_account	The email for the service account created for the bastion host

Contributing

Refer to the contribution guidelines for information on contributing to this module.

adegtyarev / terraform-google-bastion-host Goto Github PK