terraform-google-bastion-host

This module will generate a bastion host vm compatible with OS Login and IAP Tunneling that can be used to access internal VMs.

This module will:

• Create a dedicated service account for the bastion host
• Create a GCE instance to be the bastion host
• Create a firewall rule to allow TCP:22 SSH access from the IAP to the bastion
• Necessary IAM bindings to allow IAP and OS Logins from specified members

Usage

Basic usage of this module is as follows:

module "iap_bastion" {
  source = "terraform-google-modules/bastion-host/google"

  project = var.project
  zone    = var.zone
  network = google_compute_network.net.self_link
  subnet  = google_compute_subnetwork.net.self_link
  members = [
    "group:devs@example.com",
    "user:me@example.com",
  ]
}

Functional example is included in the examples directory.

Requirements

These sections describe requirements for using this module.

Software

The following dependencies must be available:

• Terraform >= v0.12
• Terraform Provider for GCP

APIs

A project with the following APIs enabled must be used to host the resources of this module:

• Google Cloud Storage JSON API: storage-api.googleapis.com
• Compute Engine API: compute.googleapis.com
• Cloud Identity-Aware Proxy API: iap.googleapis.com
• OS Login API: oslogin.googleapis.com

The Project Factory module can be used to provision a project with the necessary APIs enabled.

Permissions

This module only sets up permissions for the bastion service account, not the users who need access. To allow access, grant one of the following instance access roles.

• roles/compute.osLogin Does not grant administrator permissions
• roles/compute.osAdminLogin Grants administrator permissions.

If the user does not share the same domain as the org the bastion is in, you will also need to grant that user roles/compute.osLoginExternalUser. This is to prevent external SSH access from being granted at the project level. See the OS Login documentation for more information.

Inputs

list(object({
    network_tier           = string
    nat_ip                 = string
    public_ptr_domain_name = string
  }))

[
  {
    "nat_ip": "",
    "network_tier": "PREMIUM",
    "public_ptr_domain_name": ""
  }
]

list(object({
    network            = string
    subnetwork         = string
    subnetwork_project = string
    network_ip         = string
    nic_type           = string
    stack_type         = string
    queue_count        = number
    access_config = list(object({
      nat_ip       = string
      network_tier = string
    }))
    ipv6_access_config = list(object({
      network_tier = string
    }))
    alias_ip_range = list(object({
      ip_cidr_range         = string
      subnetwork_range_name = string
    }))
  }))

[
  "cloud-platform"
]

[
  "roles/logging.logWriter",
  "roles/monitoring.metricWriter",
  "roles/monitoring.viewer",
  "roles/compute.osLogin"
]

Outputs

Contributing

Refer to the contribution guidelines for information on contributing to this module.