{"id":26009962,"url":"https://github.com/byu-oit/terraform-aws-bastion","last_synced_at":"2026-05-29T18:31:10.367Z","repository":{"id":49200061,"uuid":"227214271","full_name":"byu-oit/terraform-aws-bastion","owner":"byu-oit","description":"Create a temporary bastion in an AWS Account","archived":false,"fork":false,"pushed_at":"2024-05-31T20:55:40.000Z","size":71,"stargazers_count":2,"open_issues_count":1,"forks_count":0,"subscribers_count":22,"default_branch":"main","last_synced_at":"2025-03-05T22:32:05.500Z","etag":null,"topics":["terraform-module","tool"],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/byu-oit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-12-10T20:57:28.000Z","updated_at":"2024-10-16T18:58:36.000Z","dependencies_parsed_at":"2024-05-03T17:27:06.549Z","dependency_job_id":"93ced926-aadb-4c5f-b7e5-f80db253b9a6","html_url":"https://github.com/byu-oit/terraform-aws-bastion","commit_stats":null,"previous_names":[],"tags_count":16,"template":false,"template_full_name":null,"purl":"pkg:github/byu-oit/terraform-aws-bastion","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/byu-oit%2Fterraform-aws-bastion","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/byu-oit%2Fterraform-aws-bastion/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/byu-oit%2Fterraform-aws-bastion/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/byu-oit%2Fterraform-aws-bastion/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/byu-oit","download_url":"https://codeload.github.com/byu-oit/terraform-aws-bastion/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/byu-oit%2Fterraform-aws-bastion/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33666290,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-29T02:00:06.066Z","response_time":107,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["terraform-module","tool"],"created_at":"2025-03-05T22:26:41.349Z","updated_at":"2026-05-29T18:31:07.182Z","avatar_url":"https://github.com/byu-oit.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Latest GitHub Release](https://img.shields.io/github/v/release/byu-oit/terraform-aws-bastion?sort=semver)\n\n# terraform-aws-bastion\n\nCreate a temporary bastion in an AWS Account\n\n**Note**\n\n\u003e This module automatically looks up the latest AMI each time `terraform\n\u003e apply` is run. This could result in your bastion EC2 instance being\n\u003e replaced. This shouldn't be a problem. The bastion is intended to be\n\u003e short lived. If this is an issue for you, you probably aren't using\n\u003e the bastion the way it is intended to be used.\n\n## Usage\n\nIn a clean directory, create a `main.tf` file that looks like:\n\n```hcl\nprovider \"aws\" {\n  version = \"~\u003e 5.0\"\n  region  = \"us-west-2\"\n}\n\nmodule \"bastion\" {\n  source            = \"github.com/byu-oit/terraform-aws-bastion.git?ref=v3.0.0\"\n  env               = \"prd\"\n  vpc_vpn_to_campus = true\n  netid             = \"mynetid\"\n  public_key        = \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwWVPlHpRiXGBmB/VG6PUeJ/Ev+Y39n5PBI4DW3ZMDT1g32nEUjzKtxK6KwVzYFQBhReMO2ry4uSTiNIzuOtHk/OCfcdPc8wbW3RlHBgbqs6p7DfYRJAXJCnWEjovijaVY0lyL4+7/YuprZwBaA2NfUIRN8UwVxZck3ULMnCK6BKog0UAE9NQZ9Z0vAtgLYPo9eVJEuGrxEszN29X+4Fl6u3T8x0XQ9EoMWU4YNwKfzBIof3th9Cbv4+FlEKpOFYuCc5vB2NPotalN8phEUqnvtsDkmCLAop6+MrUlnNNYIzmh2RLeqDF+M/ZnX8xb+V/mT9vARVcdcYCxKYeyXLvT example\"\n  #ingress_cidrs     = [\"128.187.112.21/32\"] # optional (defaults to BYU Campus)\n  #subnet_type       = private # optional (defaults to public)\n}\n\n# When you use a bastion, you almost always need to add a\n# security group rule to allow that bastion to connect to\n# another resource (RDS, EC2, EFS, etc.). You can do that in\n# Terraform, with an aws_security_group_rule resource.\n/*\nresource \"aws_security_group_rule\" \"bastion_to_rds\" {\n  type                     = \"ingress\"\n  source_security_group_id = module.bastion.security_group.id\n\n  # Different services (mysql, postgress, SSH, EFS, etc) have\n  # different ports. Specify the correct ports here.\n  from_port                = 3306\n  to_port                  = 3306\n  protocol                 = \"tcp\"\n\n  # You'll need to login to the console and lookup the\n  # Security Group ID for the target resource that your\n  # bastion is going to connect to.\n  security_group_id        = \"sg_xxxxxxxxxxxxxx\"\n}\n\noutput \"tunnel_connect\" {\n  # You'll need to login to the console and lookup the\n  # Endpoint Address of your RDS instance. If you are\n  # targeting something other than mysql on RDS, update the\n  # host and ports to match your target resource.\n  #\n  # Learn more about SSH Tunneling: https://www.ssh.com/ssh/tunneling/example\n  value = \"ssh -L 3306:my_rds_instance_address:3306 ec2-user@${module.bastion.route53_record.name}\"\n}\n*/\n\noutput \"connect\" {\n\tvalue = module.bastion.connect\n}\n```\n\nYou need to update the variable values. (i.e. use your netid, your\npublic ssh key, etc.)\n\nThen run:\n\n```shell\nterraform init\nterraform apply\n```\n\nWhen you're done, run:\n\n```shell\nterraform destroy\n```\n\n## Backend\n\nThe bastion is really intended to be ephemeral (spin it up, use it, tear\nit down). So there's no need for a backend.\n\n## Input\n\n| Name              | Type         | Description                                                                     | Default Value                                          |\n|:------------------|:-------------|:--------------------------------------------------------------------------------|:-------------------------------------------------------|\n| env               | string       | Environment (for tagging the bastion) (e.g. dev, prd)                           |                                                        |\n| vpc_vpn_to_campus | bool         | Set to true if the bastion needs to be in the VPC that has VPN access to campus | false                                                  |\n| netid             | string       | Your Net ID (for naming the bastion)                                            |                                                        |\n| public_key        | string       | Public SSH Key (e.g. \\\"ssh-rsa AA....Qw== comment\\\").                           |                                                        |\n| ingress_cidrs     | list(string) | IP Address Ranges that should have access to the bastion.                       | [\"128.187.0.0/16\", \"10.0.0.0/8\"]                       |\n| subnet_type       | string       | Which subnet type sould the bastion launch in? (e.g. public, private, data)     | \"public\"                                               |\n| site_url          | string       | The static URL to use as an alias to the bastion host address.                  | \"${var.netid}-bastion.${module.acs.route53_zone.name}\" |\n| site_zone_id      | string       | The ID of the hosted zone to contain the site_url record.                       | module.acs.route53_zone.zone_id                        |\n\nNotes on `subnet_type`:\n\n* `public` is useful for troubleshooting when your target is inside AWS.\n  But the public subnets don't have routing to the VPN, so you won't be\n  able to reach back to campus from the bastion.\n* `private` is useful for troubleshooting connections back to campus\n  across the VPN. But you won't be able to reach the bastion publicly\n  from your workstation.\n* If you need a `private` bastion, you'll either need to reach it across\n  the VPN (i.e. be running the dc vpn on your workstation), or spin up a\n  second \"public\" bastion to go through.\n\n## Output\n\n| Name           | Type                                                                                                                      | Description                                                              |\n|:---------------|:--------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------|\n| connect        | string                                                                                                                    | SSH connection details for the bastion                                   |\n| ec2_instance   | [object](https://www.terraform.io/docs/providers/aws/r/instance.html#attributes-reference)                                | The bastion EC2 Instance                                                 |\n| security_group | [object](https://www.terraform.io/docs/providers/aws/r/security_group.html#attributes-reference)                          | The security group that controls access to the bastion                   |\n| key_pair       | [object](https://www.terraform.io/docs/providers/aws/r/key_pair.html#attributes-reference)                                | The SSH keypair assigned to the bastion                                  |\n| route53_record | [object](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record#attributes-reference) | The Route53 \"A\" Record to alias the bastion public or private IP address |\n\n## Resources\n\n* An EC2 Instance (the bastion) in a public subnet\n* A Security Group allowing SSH on port 22 from campus\n* A keypair using the public key input variable (granting access to the\n  EC2 instance)\n* A Route53 entry to alias the bastion public or private ip address\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbyu-oit%2Fterraform-aws-bastion","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbyu-oit%2Fterraform-aws-bastion","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbyu-oit%2Fterraform-aws-bastion/lists"}