guimove / terraform-aws-bastion Goto Github PK

  # aws_instance.mgmt[1] will be updated in-place
  ~ resource "aws_instance" "mgmt" {
        ami                          = "ami-0dd655843c87b6930"
        arn                          = "arn:aws:ec2:us-west-1:redacted:instance/i-0441redacted"
        associate_public_ip_address  = false
        availability_zone            = "us-west-1b"
        cpu_core_count               = 2
        cpu_threads_per_core         = 1
        disable_api_termination      = false
        ebs_optimized                = false
        get_password_data            = false
        id                           = "i-0441redacted"
        instance_state               = "running"
        instance_type                = "t2.medium"
        ipv6_address_count           = 0
        ipv6_addresses               = []
        key_name                     = "key-dev"
        monitoring                   = false
        primary_network_interface_id = "eni-030bredacted"
        private_dns                  = "ip-172-22-2-22.us-west-1.compute.internal"
        private_ip                   = "172.22.2.22"
        security_groups              = []
        source_dest_check            = true
        subnet_id                    = "subnet-0cferedacted"
        tags                         = {
            "Customer" = "dev"
            "Name"     = "mgmt-ui-instance-dev"
        }
        tenancy                      = "default"
        volume_tags                  = {}
      ~ vpc_security_group_ids       = [
            "sg-07acredacted",
            "sg-0c439redacted",
        ] -> (known after apply)

        credit_specification {
            cpu_credits = "standard"
        }

        root_block_device {
            delete_on_termination = true
            encrypted             = false
            iops                  = 100
            volume_id             = "vol-03ddredacted"
            volume_size           = 8
            volume_type           = "gp2"
        }
    }

  # module.bastion.aws_security_group.bastion_host_security_group (deposed object cbcdd9a2) will be destroyed
  - resource "aws_security_group" "bastion_host_security_group" {
      - arn                    = "arn:aws:ec2:us-west-1:redacted:security-group/sg-0ed3redacted" -> null
      - description            = "Enable SSH access to the bastion host from external via SSH port" -> null
      - egress                 = [] -> null
      - id                     = "sg-0ed3redacted" -> null
      - ingress                = [] -> null
      - name                   = "lc-host" -> null
      - owner_id               = "redacted" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "Customer" = "dev"
          - "Name"     = "bastion-dev"
        } -> null
      - vpc_id                 = "vpc-0e28redacted" -> null
    }

  # module.bastion.aws_security_group.private_instances_security_group must be replaced
-/+ resource "aws_security_group" "private_instances_security_group" {
      ~ arn                    = "arn:aws:ec2:us-west-1:redacted:security-group/sg-0c43redacted" -> (known after apply)
        description            = "Enable SSH access to the Private instances from the bastion via SSH port"
      ~ egress                 = [] -> (known after apply)
      ~ id                     = "sg-0c43redacted" -> (known after apply)
      ~ ingress                = [] -> (known after apply)
      ~ name                   = "lc-priv-instances" -> "bastion-dev-dev-priv-instances" # forces replacement
      ~ owner_id               = "redacted" -> (known after apply)
        revoke_rules_on_delete = false
        tags                   = {
            "Customer" = "dev"
            "Name"     = "bastion-dev"
        }
        vpc_id                 = "vpc-0e28redacted"
    }

  # module.bastion.aws_security_group_rule.ingress_instances will be created
  + resource "aws_security_group_rule" "ingress_instances" {
      + description              = "Incoming traffic from bastion"
      + from_port                = 22
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + self                     = false
      + source_security_group_id = "sg-09c2redacted"
      + to_port                  = 22
      + type                     = "ingress"
    }

module "bastion" {
  source                             = "github.com/Guimove/terraform-aws-bastion"
}

module "bastion" {
  "source" = "Guimove/bastion/aws"
}

public-keys/user1.pub
public-keys/user2.pub	public-keys/user3.pub	public-keys/user4.pub

public-keys/user1.pub
public-keys/user2.pub
public-keys/user3.pub
public-keys/user4.pub

Error: module.bastion.aws_lb_target_group.bastion_lb_target_group: expected health_check.0.healthy_threshold to be in the range (2 - 10), got 1

Host bastion.myhost.com
  	Hostname bastion.myhost.com
  	User aaron
    ForwardAgent no
  	IdentityFile ~/.ssh/id_rsa

Host 10.0.1.*
    User ubuntu
    IdentityFile ~/.ssh/my_key.pem
    ProxyCommand ssh -q -W %h:%p bastion.myhost.com

resource "aws_kms_alias" "alias" {
  name          = "alias/${var.bucket_name}"
  target_key_id = aws_kms_key.key.arn
}

Error: "name" must begin with 'alias/' and be comprised of only [a-zA-Z0-9:/_-]

  on ../modules/terraform-aws-bastion/main.tf line 15, in resource "aws_kms_alias" "alias":
  15: resource "aws_kms_alias" "alias" {

data "aws_ami" "ami" {
  most_recent = true
  owners      = ["amazon"]
  name_regex  = "^amzn2-ami-hvm.*-ebs"

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}

+ yum -y update --security
Loaded plugins: priorities, update-motd, upgrade-helper


 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Disable the repository, so yum won't use it by default. Yum will then
        just ignore the repository until you permanently enable it again or use
        --enablerepo for temporary usage:

            yum-config-manager --disable <repoid>

     4. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true

Cannot find a valid baseurl for repo: amzn-main/latest
Could not retrieve mirrorlist http://repo.us-east-1.amazonaws.com/latest/main/mirror.list error was
12: Timeout on http://repo.us-east-1.amazonaws.com/latest/main/mirror.list: (28, 'Connection timed out after 10001 milliseconds')

data "aws_subnet" "subnets" {
  count = "${length(var.elb_subnets)}"
  id    = "${var.elb_subnets[count.index]}"
}

resource "aws_security_group_rule" "ingress_bastion" {
  description = "Incoming traffic to bastion"
  type        = "ingress"
  from_port   = "${var.public_ssh_port}"
  to_port     = "${var.public_ssh_port}"
  protocol    = "TCP"
  cidr_blocks = ["${concat(data.aws_subnet.subnets.*.cidr_block, var.cidrs)}"]

  security_group_id = "${aws_security_group.bastion_host_security_group.id}"
}

Error: Invalid argument name

  on .terraform/modules/bastion/Guimove-terraform-aws-bastion-c1acebe/main.tf line 25, in resource "aws_s3_bucket" "bucket":
  25:       "rule"      = "log"

Error: module.bastion-host.module.bastion.data.aws_ami.amazon-linux-2: "owners": required field is not set

module "bastion" {
  source                      = "Guimove/bastion/aws"
  bucket_name                 = "${var.bastion_bucket_name}"
  region                      = var.region
  vpc_id                      = aws_vpc.main.id
  is_lb_private               = false
  bastion_host_key_pair       = aws_key_pair.ec2key.id
  create_dns_record           = false
  elb_subnets                 = aws_subnet.pub_sn.*.id
  auto_scaling_group_subnets  = aws_subnet.pub_sn.*.id
  tags = {
    Name =  "${var.bastion_bucket_name}"
  }
}

resource "aws_s3_bucket_object" "bastion_key" {
  bucket  = module.bastion.bucket_name
  key     = "public-keys/${var.current_user}.pub"
  source  = var.public_key_path
}

resource "aws_instance" "web" {
  # Make one for each subnet. In the future we might want to do some sort of autoscaling
  # group, but I don't think the mgmt ui is customer facing so it may not be neccessary
  count = length(aws_subnet.priv_sn)

  # The connection block tells the provisioner how to communicate with the instance 
  connection {
    # The default username for our AMI
    user = "ubuntu"
    host = self.public_ip
    # The connection will use the local SSH agent for authentication.
    bastion_host = module.bastion.elb_ip
    bastion_user = var.current_user
    bastion_private_key = file(var.private_key_path)
  }

  instance_type = "t2.medium"

  # Lookup the correct AMI based on the region we specified
  ami = lookup(var.ec2amis, var.region)

  # The name of the SSH keypair we created above
  key_name = aws_key_pair.ec2key.id

  # Security group to allow HTTP and SSH access
  vpc_security_group_ids = [
    aws_security_group.web.id, 
    module.bastion.private_instances_security_group
  ]

  # We're going to define these guys in the "private" subnet, although
  # right now our configuration only has one set of subnets
  subnet_id = aws_subnet.priv_sn[count.index].id

  # Creates a folder with the code in it on the remote. 
  provisioner "file" {
    source = var.code_folder
    destination = "/home/ubuntu/code"
  }

  # We run a remote provisioner on the instance after creating it. By default, just
  # updates apt-get, but we can add whatever we want to it.
  provisioner "remote-exec" {
    inline = [
      "sudo apt-get -y update",
    ]
  }

  tags = {
    Name = "web"
  }

  depends_on = [aws_s3_bucket_object.bastion_key]
}

Host myserver.mycompany.com
    ProxyCommand ssh bastion.mycompany.com -W %h:%p

module "bastion" {
  source = "git::https://github.com/Guimove/terraform-aws-bastion.git?ref=master"
  bucket_name = module.bastion_logs_s3.bucket_id
  region = var.region
  vpc_id = module.vpc.vpc_id
  is_lb_private = "false"
  bastion_host_key_pair = var.stage
  hosted_zone_name = var.hosted_zone_id
  bastion_record_name = local.bastion_hostname
  elb_subnets = module.subnets.public_subnet_ids
  auto_scaling_group_subnets = module.subnets.public_subnet_ids
  create_dns_record = "true"
  tags = var.tags
}

  # module.bastion.aws_autoscaling_group.bastion_auto_scaling_group must be replaced
+/- resource "aws_autoscaling_group" "bastion_auto_scaling_group" {
      ~ arn                       = "..." -> (known after apply)
      ~ availability_zones        = [ ... ] -> (known after apply)
        default_cooldown          = 180
        desired_capacity          = 1
      - enabled_metrics           = [] -> null
        force_delete              = false
        health_check_grace_period = 180
        health_check_type         = "EC2"
      ~ id                        = "..." -> (known after apply)
      ~ launch_configuration      = "..." -> (known after apply)
      ~ load_balancers            = [] -> (known after apply)
        max_size                  = 1
        metrics_granularity       = "1Minute"
        min_size                  = 1
      ~ name                      = "..." -> (known after apply) # forces replacement
        protect_from_scale_in     = false
      ~ service_linked_role_arn   = "..." -> (known after apply)
      - suspended_processes       = [] -> null
      ~ tags                      = [  ...  ] -> (known after apply)
        target_group_arns         = [
            "a...",
        ]
        termination_policies      = [
            "OldestLaunchConfiguration",
        ]
        vpc_zone_identifier       = [
            ...
        ]
        wait_for_capacity_timeout = "10m"
    }

  # module.bastion.aws_launch_configuration.bastion_launch_configuration must be replaced
+/- resource "aws_launch_configuration" "bastion_launch_configuration" {
        associate_public_ip_address      = true
      ~ ebs_optimized                    = false -> (known after apply)
        enable_monitoring                = true
        iam_instance_profile             = "..."
      ~ id                               = "..." -> (known after apply)
        image_id                         = "ami-010a7fa92957a6a71"
        instance_type                    = "t2.nano"
        key_name                         = "..."
      ~ name                             = "..." -> (known after apply)
        name_prefix                      = "..."
        security_groups                  = [ ... ]
      ~ user_data                        = "6a4294ecb9d7bcd7a1d6667c893e762a89cb637f" -> "bef2c6b2a35ff4b2641a209256fddb3bb0e0227f" # forces replacement
      - vpc_classic_link_security_groups = [] -> null

      + ebs_block_device { ... }

      + root_block_device { ... }
    }

public_ssh_port = 22022
private_ssh_port = 22

 lifecycle_rule {
    id      = "log"
    enabled = true

    prefix  = "log/"
    tags {
      "rule"      = "log"
      "autoclean" = "${var.log_auto_clean}"
    }

    transition {
      days          = "${var.log_standard_ia_days}"
      storage_class = "STANDARD_IA"
    }

    transition {
      days          = "${var.log_glacier_days}"
      storage_class = "GLACIER"
    }

    expiration {
      days = "${var.log_expiry_days}"
    }
  }

resource "aws_security_group" "bastion_host_security_group" {
  description = "Enable SSH access to the bastion host from external via SSH port"
  vpc_id      = "${var.vpc_id}"

  tags = "${merge(var.tags)}"
}

resource "aws_security_group_rule" "ingress_bastion" {
  description = "Incoming traffic to bastion"
  type        = "ingress"
  from_port   = "${var.public_ssh_port}"
  to_port     = "${var.public_ssh_port}"
  protocol    = "TCP"
  cidr_blocks = "${var.cidrs}"

  security_group_id = "${aws_security_group.bastion_host_security_group.id}"
}

resource "aws_security_group_rule" "egress_bastion" {
  description = "Outgoing traffic from bastion to instances"
  type        = "egress"
  from_port   = "0"
  to_port     = "65535"
  protocol    = "-1"
  cidr_blocks = ["0.0.0.0/0"]

  security_group_id = "${aws_security_group.bastion_host_security_group.id}"
}