{"id":13491250,"url":"https://github.com/terraform-google-modules/terraform-google-bastion-host","last_synced_at":"2025-11-09T08:30:31.910Z","repository":{"id":33393298,"uuid":"146224044","full_name":"terraform-google-modules/terraform-google-bastion-host","owner":"terraform-google-modules","description":"Generates a bastion host VM compatible with OS Login and IAP Tunneling that can be used to access internal VMs","archived":false,"fork":false,"pushed_at":"2024-12-18T22:53:52.000Z","size":446,"stargazers_count":128,"open_issues_count":7,"forks_count":90,"subscribers_count":27,"default_branch":"master","last_synced_at":"2024-12-28T07:18:03.118Z","etag":null,"topics":["cft-terraform","developer-tools","operations","security-identity"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/terraform-google-modules/bastion-host/google","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/terraform-google-modules.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-08-26T23:25:30.000Z","updated_at":"2024-11-27T16:47:19.000Z","dependencies_parsed_at":"2023-10-27T22:36:34.798Z","dependency_job_id":"536c9902-faf4-48bc-9ce8-443eed1564ea","html_url":"https://github.com/terraform-google-modules/terraform-google-bastion-host","commit_stats":null,"previous_names":[],"tags_count":33,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bastion-host","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bastion-host/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bastion-host/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bastion-host/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/terraform-google-modules","download_url":"https://codeload.github.com/terraform-google-modules/terraform-google-bastion-host/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239571542,"owners_count":19661164,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cft-terraform","developer-tools","operations","security-identity"],"created_at":"2024-07-31T19:00:54.914Z","updated_at":"2025-11-09T08:30:31.861Z","avatar_url":"https://github.com/terraform-google-modules.png","language":"HCL","funding_links":[],"categories":["HCL"],"sub_categories":[],"readme":"# terraform-google-bastion-host\n\nThis module will generate a bastion host vm compatible with [OS Login](https://cloud.google.com/compute/docs/oslogin/) and [IAP Tunneling](https://cloud.google.com/iap/) that can be used to access internal VMs.\n\nThis module will:\n\n- Create a dedicated service account for the bastion host\n- Create a GCE instance to be the bastion host\n- Create a firewall rule to allow TCP:22 SSH access from the IAP to the bastion\n- Necessary IAM bindings to allow IAP and OS Logins from specified members\n\n## Usage\n\nBasic usage of this module is as follows:\n\n```hcl\nmodule \"iap_bastion\" {\n  source = \"terraform-google-modules/bastion-host/google\"\n\n  project = var.project\n  zone    = var.zone\n  network = google_compute_network.net.self_link\n  subnet  = google_compute_subnetwork.net.self_link\n  members = [\n    \"group:devs@example.com\",\n    \"user:me@example.com\",\n  ]\n}\n```\n\nFunctional example is included in the\n[examples](./examples/) directory.\n\n## Requirements\n\nThese sections describe requirements for using this module.\n\n### Software\n\nThe following dependencies must be available:\n\n- [Terraform][terraform] \u003e= v0.12\n- [Terraform Provider for GCP][terraform-provider-gcp]\n\n### APIs\n\nA project with the following APIs enabled must be used to host the\nresources of this module:\n\n- Google Cloud Storage JSON API: `storage-api.googleapis.com`\n- Compute Engine API: `compute.googleapis.com`\n- Cloud Identity-Aware Proxy API: `iap.googleapis.com`\n- OS Login API: `oslogin.googleapis.com`\n\nThe [Project Factory module][project-factory-module] can be used to\nprovision a project with the necessary APIs enabled.\n\n### Permissions\n\nThis module only sets up permissions for the bastion service account, not the users who need access. To allow access, grant one of the following instance access roles.\n\n* `roles/compute.osLogin` Does not grant administrator permissions\n* `roles/compute.osAdminLogin` Grants administrator permissions.\n\nIf the user does not share the same domain as the org the bastion is in, you will also need to grant that user `roles/compute.osLoginExternalUser`. This is to prevent external SSH access from being granted at the project level. See the [OS Login documentation](https://cloud.google.com/compute/docs/instances/managing-instance-access#configure_users) for more information.\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| access\\_config | Access configs for network, nat\\_ip and DNS | \u003cpre\u003elist(object({\u003cbr\u003e    network_tier           = string\u003cbr\u003e    nat_ip                 = string\u003cbr\u003e    public_ptr_domain_name = string\u003cbr\u003e  }))\u003c/pre\u003e | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"nat_ip\": \"\",\u003cbr\u003e    \"network_tier\": \"PREMIUM\",\u003cbr\u003e    \"public_ptr_domain_name\": \"\"\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| additional\\_networks | Additional network interface details for the instance template, if any. | \u003cpre\u003elist(object({\u003cbr\u003e    network            = string\u003cbr\u003e    subnetwork         = string\u003cbr\u003e    subnetwork_project = string\u003cbr\u003e    network_ip         = string\u003cbr\u003e    nic_type           = string\u003cbr\u003e    stack_type         = string\u003cbr\u003e    queue_count        = number\u003cbr\u003e    access_config = list(object({\u003cbr\u003e      nat_ip       = string\u003cbr\u003e      network_tier = string\u003cbr\u003e    }))\u003cbr\u003e    ipv6_access_config = list(object({\u003cbr\u003e      network_tier = string\u003cbr\u003e    }))\u003cbr\u003e    alias_ip_range = list(object({\u003cbr\u003e      ip_cidr_range         = string\u003cbr\u003e      subnetwork_range_name = string\u003cbr\u003e    }))\u003cbr\u003e  }))\u003c/pre\u003e | `[]` | no |\n| additional\\_ports | A list of additional ports/ranges to open access to on the instances from IAP. | `list(string)` | `[]` | no |\n| can\\_ip\\_forward | Whether the bastion should allow IP forwarding. | `bool` | `false` | no |\n| create\\_firewall\\_rule | If we need to create the firewall rule or not. | `bool` | `true` | no |\n| create\\_instance\\_from\\_template | Whether to create and instance from the template or not. If false, no instance is created, but the instance template is created and usable by a MIG | `bool` | `true` | no |\n| disk\\_labels | Key-value map of labels to assign to the bastion host disk | `map(any)` | `{}` | no |\n| disk\\_size\\_gb | Boot disk size in GB | `number` | `100` | no |\n| disk\\_type | Boot disk type, can be either pd-ssd, local-ssd, or pd-standard | `string` | `\"pd-standard\"` | no |\n| external\\_ip | Set to true if an ephemeral or static external IP/DNS is required, must also set access\\_config if true | `bool` | `false` | no |\n| fw\\_name\\_allow\\_ssh\\_from\\_iap | Firewall rule name for allowing SSH from IAP | `string` | `\"allow-ssh-from-iap-to-tunnel\"` | no |\n| host\\_project | The network host project ID | `string` | `\"\"` | no |\n| image | Source image for the Bastion. If image is not specified, image\\_family will be used (which is the default). | `string` | `\"\"` | no |\n| image\\_family | Source image family for the Bastion. | `string` | `\"debian-12\"` | no |\n| image\\_project | Project where the source image for the Bastion comes from | `string` | `\"debian-cloud\"` | no |\n| labels | Key-value map of labels to assign to the bastion host | `map(any)` | `{}` | no |\n| machine\\_type | Instance type for the Bastion host | `string` | `\"n1-standard-1\"` | no |\n| members | List of IAM resources to allow access to the bastion host | `list(string)` | `[]` | no |\n| metadata | Key-value map of additional metadata to assign to the instances | `map(string)` | `{}` | no |\n| name | Name of the Bastion instance | `string` | `\"bastion-vm\"` | no |\n| name\\_prefix | Name prefix for instance template | `string` | `\"bastion-instance-template\"` | no |\n| network | Self link for the network on which the Bastion should live | `string` | n/a | yes |\n| network\\_ip | Private IP address for the bastion host | `string` | `\"\"` | no |\n| preemptible | Allow the instance to be preempted | `bool` | `false` | no |\n| project | The project ID to deploy to | `string` | n/a | yes |\n| random\\_role\\_id | Enables role random id generation. | `bool` | `true` | no |\n| region | The region where the bastion instance template will live | `string` | `null` | no |\n| scopes | List of scopes to attach to the bastion host | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"cloud-platform\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| service\\_account\\_email | If set, the service account and its permissions will not be created. The service account being passed in should have at least the roles listed in the `service_account_roles` variable so that logging and OS Login work as expected. | `string` | `\"\"` | no |\n| service\\_account\\_name | Account ID for the service account | `string` | `\"bastion\"` | no |\n| service\\_account\\_roles | List of IAM roles to assign to the service account. | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"roles/logging.logWriter\",\u003cbr\u003e  \"roles/monitoring.metricWriter\",\u003cbr\u003e  \"roles/monitoring.viewer\",\u003cbr\u003e  \"roles/compute.osLogin\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| service\\_account\\_roles\\_supplemental | An additional list of roles to assign to the bastion if desired | `list(string)` | `[]` | no |\n| shielded\\_vm | Enable shielded VM on the bastion host (recommended) | `bool` | `true` | no |\n| startup\\_script | Render a startup script with a template. | `string` | `\"\"` | no |\n| subnet | Self link for the subnet on which the Bastion should live. Can be private when using IAP | `string` | n/a | yes |\n| tags | Network tags, provided as a list | `list(string)` | `[]` | no |\n| zone | The primary zone where the bastion host will live | `string` | `\"us-central1-a\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| hostname | Host name of the bastion |\n| instance\\_template | Self link of the bastion instance template for use with a MIG |\n| ip\\_address | Internal IP address of the bastion host |\n| self\\_link | Self link of the bastion host |\n| service\\_account | The email for the service account created for the bastion host |\n\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n\n## Contributing\n\nRefer to the [contribution guidelines](./CONTRIBUTING.md) for\ninformation on contributing to this module.\n\n[iam-module]: https://registry.terraform.io/modules/terraform-google-modules/iam/google\n[project-factory-module]: https://registry.terraform.io/modules/terraform-google-modules/project-factory/google\n[terraform-provider-gcp]: https://www.terraform.io/docs/providers/google/index.html\n[terraform]: https://www.terraform.io/downloads.html\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-google-modules%2Fterraform-google-bastion-host","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fterraform-google-modules%2Fterraform-google-bastion-host","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-google-modules%2Fterraform-google-bastion-host/lists"}