{"id":24087278,"url":"https://github.com/hazelops/terraform-aws-tailscale","last_synced_at":"2026-03-04T15:01:41.453Z","repository":{"id":191716095,"uuid":"685214816","full_name":"hazelops/terraform-aws-tailscale","owner":"hazelops","description":null,"archived":false,"fork":false,"pushed_at":"2025-04-07T14:54:00.000Z","size":78,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-01-30T16:54:30.774Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hazelops.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security.tf","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-08-30T18:50:46.000Z","updated_at":"2025-04-07T14:53:31.000Z","dependencies_parsed_at":"2024-05-13T07:24:14.590Z","dependency_job_id":"fb6fae14-a8ce-4ce9-8388-61fdad2e2d5e","html_url":"https://github.com/hazelops/terraform-aws-tailscale","commit_stats":null,"previous_names":["hazelops/terraform-aws-tailscale"],"tags_count":9,"template":false,"template_full_name":null,"purl":"pkg:github/hazelops/terraform-aws-tailscale","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazelops%2Fterraform-aws-tailscale","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazelops%2Fterraform-aws-tailscale/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazelops%2Fterraform-aws-tailscale/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazelops%2Fterraform-aws-tailscale/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hazelops","download_url":"https://codeload.github.com/hazelops/terraform-aws-tailscale/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazelops%2Fterraform-aws-tailscale/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29986255,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-01T21:06:37.093Z","status":"ssl_error","status_checked_at":"2026-03-01T21:05:45.052Z","response_time":124,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-10T03:03:27.032Z","updated_at":"2026-03-04T15:01:41.417Z","avatar_url":"https://github.com/hazelops.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Terraform AWS Tailscale Module\nThis module is used to deploy a [Tailscale](https://tailscale.com) router instance to set up access from VPC to the\nTailscale Cloud.\n\nModule logic is the following:\n1. Connect to Tailscale API using the Terraform Provider and Tailscale api token.\n2. Generate Tailscale Auth Key and place it into the instance.\n3. Create an Autoscale Group with a single instance using and connect it to the TailScale network.\n\n## Usage\n\n_Please refer to [Tailscale Configuration](#tailscale-configuration) first_\n\n```terraform\nmodule \"tailscale\" {\n  source            = \"registry.terraform.io/hazelops/tailscale/aws\"\n  version           = \"~\u003e2.0\"\n  allowed_cidr_blocks = [\"0.0.0.0/0\"] # Please lock this down to your specific CIDR\n  ec2_key_pair_name = \"default-key\"\n  env               = \"prod\"\n  subnets           = [\"subnet-0000000\", \"subnet-0000000\"]\n  vpc_id            = \"vpc-0000000\"\n  api_token         = \"00000000000000000000000000\" # Please don't store secrets in plain text\n}\n\n```\nMore examples can be found in the [examples directory](./examples).\n\n## Tailscale Configuration\n\n1. Create [Tailscale API access token](https://login.tailscale.com/admin/settings/keys) (More info on Access tokens can be found [here](https://tailscale.com/kb/1083/acl-tags#access-tokens)\n2. Add tag to the [ACL control list](https://login.tailscale.com/admin/acls/file). ACL should look like this:\n  ```json\n  {\n  \"acls\": [\n    {\n      \"action\": \"accept\",\n      \"ports\": [\n        \"*:*\"\n      ],\n      \"users\": [\n        \"*\"\n      ]\n    }\n  ],\n  \"tagOwners\": {\n    \"tag:\u003cyour-environment\u003e\": []\n  }\n}\n```\n\nMake sure to approve the advertised route:\n1. Go to [Machines](https://login.tailscale.com/admin/machines) page\n2. Find the machine and click on the `...` button.\n3. Select \"Edit route settings\", check the checkbox and then click \"Save\".\n\n**_The tag must be added to the ACL to disable automatic key expiration!_**\n\nDefault parameter for tag is `tag:\u003cyour-environment\u003e`.\n\nMore examples can be found in [Tailscale Tag Docs](https://tailscale.com/kb/1068/acl-tags#defining-a-tag).\n\n3. Create AWS SSM Parameter using the obtained Tailscale API access token. For example, use the following path\n   pattern: `\u003cenv-name\u003e/global/tailscale_api_token`. For more information please refer\n   to [AWS Docs](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-create-console.html).\n4. Add data source to Terraform code like in the [example configuration main.tf file](./examples/minimum/main.tf).\n5. In the module call parameters, set `api_token` variable like in\n   the [example configuration main.tf file](./examples/minimum/main.tf).\n6. Alternatively Tailscale API token could be set as string, but this is very unsafe, therefore it is *\n   *_highly not recommended_** to do this.\n\n## Troubleshooting\n\nThe following error may occur during module removal:\n\n```text\nError: Provider configuration not present\n\nTo work with module.tailscale.tailscale_tailnet_key.this (orphan) its\noriginal provider configuration at\nmodule.tailscale.provider[\"registry.terraform.io/tailscale/tailscale\"] is\nrequired, but it has been removed. This occurs when a provider\nconfiguration is removed while objects created by that provider still exist\nin the state. Re-add the provider configuration to destroy\nmodule.tailscale.tailscale_tailnet_key.this (orphan), after which you can\nremove the provider configuration again.\n```\n\nTo remove it, run the following code:\n\n```shell\nterraform state rm module.tailscale.tailscale_tailnet_key.this\n```\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e=1.2.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e=4.30.0 |\n| \u003ca name=\"requirement_tailscale\"\u003e\u003c/a\u003e [tailscale](#requirement\\_tailscale) | 0.18 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e=4.30.0 |\n| \u003ca name=\"provider_tailscale\"\u003e\u003c/a\u003e [tailscale](#provider\\_tailscale) | 0.18 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_autoscaling_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group) | resource |\n| [aws_iam_instance_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |\n| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_launch_template.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |\n| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |\n| [tailscale_tailnet_key.this](https://registry.terraform.io/providers/tailscale/tailscale/0.18/docs/resources/tailnet_key) | resource |\n| [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |\n| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_allowed_cidr_blocks\"\u003e\u003c/a\u003e [allowed\\_cidr\\_blocks](#input\\_allowed\\_cidr\\_blocks) | List of network subnets that are allowed. According to PCI-DSS, CIS AWS and SOC2 providing a default wide-open CIDR is not secure. | `list(string)` | n/a | yes |\n| \u003ca name=\"input_ami_id\"\u003e\u003c/a\u003e [ami\\_id](#input\\_ami\\_id) | Optional AMI ID for Tailscale instance. Otherwise latest Amazon Linux will be used. One might want to lock this down to avoid unexpected upgrades. | `string` | `\"\"` | no |\n| \u003ca name=\"input_api_token\"\u003e\u003c/a\u003e [api\\_token](#input\\_api\\_token) | Tailscale API access token | `string` | n/a | yes |\n| \u003ca name=\"input_asg\"\u003e\u003c/a\u003e [asg](#input\\_asg) | Scaling settings of an Auto Scaling Group | `map(any)` | \u003cpre\u003e{\u003cbr\u003e  \"max_size\": 1,\u003cbr\u003e  \"min_size\": 1\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_ec2_key_pair_name\"\u003e\u003c/a\u003e [ec2\\_key\\_pair\\_name](#input\\_ec2\\_key\\_pair\\_name) | EC2 key pair name to use for Tailscale instance | `string` | n/a | yes |\n| \u003ca name=\"input_env\"\u003e\u003c/a\u003e [env](#input\\_env) | Environment name (typically dev/prod) | `string` | n/a | yes |\n| \u003ca name=\"input_ext_security_groups\"\u003e\u003c/a\u003e [ext\\_security\\_groups](#input\\_ext\\_security\\_groups) | External security groups to add to the Tailscale instance | `list(any)` | `[]` | no |\n| \u003ca name=\"input_instance_type\"\u003e\u003c/a\u003e [instance\\_type](#input\\_instance\\_type) | Type of Tailscale instance | `string` | `\"t4g.nano\"` | no |\n| \u003ca name=\"input_key_ephemeral\"\u003e\u003c/a\u003e [key\\_ephemeral](#input\\_key\\_ephemeral) | Indicates whether the key is ephemeral | `bool` | `true` | no |\n| \u003ca name=\"input_key_expiry\"\u003e\u003c/a\u003e [key\\_expiry](#input\\_key\\_expiry) | Expiry of the key in seconds. Defaults to 7776000 (90 days) | `number` | `7776000` | no |\n| \u003ca name=\"input_key_preauthorized\"\u003e\u003c/a\u003e [key\\_preauthorized](#input\\_key\\_preauthorized) | Determines whether or not the machines authenticated by the key will be authorized for the Tailnet by default | `bool` | `true` | no |\n| \u003ca name=\"input_key_reusable\"\u003e\u003c/a\u003e [key\\_reusable](#input\\_key\\_reusable) | Indicates whether the key is reusable | `bool` | `true` | no |\n| \u003ca name=\"input_monitoring_enabled\"\u003e\u003c/a\u003e [monitoring\\_enabled](#input\\_monitoring\\_enabled) | Whether to enable monitoring for the Auto Scaling Group | `bool` | `true` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | Name for Tailscale instance | `string` | `\"tailscale-router\"` | no |\n| \u003ca name=\"input_public_ip_enabled\"\u003e\u003c/a\u003e [public\\_ip\\_enabled](#input\\_public\\_ip\\_enabled) | Wheter to enable a public IP for Tailscale instance | `bool` | `false` | no |\n| \u003ca name=\"input_ssm_role_arn\"\u003e\u003c/a\u003e [ssm\\_role\\_arn](#input\\_ssm\\_role\\_arn) | SSM role to attach to a Tailscale instance | `string` | `\"arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM\"` | no |\n| \u003ca name=\"input_subnets\"\u003e\u003c/a\u003e [subnets](#input\\_subnets) | Subnets where the Taiscale instance will be placed. It is recommended to use a private subnet for better security. | `list(string)` | n/a | yes |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | AWS tags for the Tailscale instance | `map(string)` | `{}` | no |\n| \u003ca name=\"input_tailscale_tags\"\u003e\u003c/a\u003e [tailscale\\_tags](#input\\_tailscale\\_tags) | List of Tailscale tags for the Tailnet device. It would be automatically tagged when it is authenticated with this key | `list(string)` | `[]` | no |\n| \u003ca name=\"input_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#input\\_vpc\\_id) | VPC ID where the Tailscale instance will be placed | `string` | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_autoscaling_group_id\"\u003e\u003c/a\u003e [autoscaling\\_group\\_id](#output\\_autoscaling\\_group\\_id) | n/a |\n| \u003ca name=\"output_name\"\u003e\u003c/a\u003e [name](#output\\_name) | n/a |\n| \u003ca name=\"output_security_group_id\"\u003e\u003c/a\u003e [security\\_group\\_id](#output\\_security\\_group\\_id) | n/a |\n\u003c!-- END_TF_DOCS --\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhazelops%2Fterraform-aws-tailscale","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhazelops%2Fterraform-aws-tailscale","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhazelops%2Fterraform-aws-tailscale/lists"}