Merge pull request #9016 from ministryofjustice/TM-810

[TM-810] OAS: added bastion

terraform/environments/oas/bastion.tf

@@ -0,0 +1,32 @@
+locals {
+  public_key_data = jsondecode(file("./files/bastion_linux.json"))
+}
+
+module "bastion_linux" {
+  source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.0"
+
+  providers = {
+    aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
+    aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
+  }
+  # s3 - used for logs and user ssh public keys
+  bucket_name = "bastion-${local.application_name}"
+  # public keys
+  public_key_data = local.public_key_data.keys[local.environment]
+  # logs
+  log_auto_clean       = "Enabled"
+  log_standard_ia_days = 30  # days before moving to IA storage
+  log_glacier_days     = 60  # days before moving to Glacier
+  log_expiry_days      = 180 # days before log expiration
+  # bastion
+  allow_ssh_commands = false
+  app_name           = var.networking[0].application
+  business_unit      = local.vpc_name
+  subnet_set         = local.subnet_set
+  environment        = local.environment
+  region             = "eu-west-2"
+
+  # Tags
+  tags_common = local.tags
+  tags_prefix = terraform.workspace
+}

terraform/environments/oas/ec2.tf

@@ -141,6 +141,13 @@ resource "aws_security_group" "ec2" {
     protocol    = "tcp"
     cidr_blocks = [local.application_data.accounts[local.environment].inbound_cidr_lz]
   }
+  ingress {
+    description = "SSH from the Bastion"
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    security_groups = [module.bastion_linux.bastion_security_group]
+  }
 
   egress {
     description = "Allow AWS SSM Session Manager"

terraform/environments/oas/files/bastion_linux.json

@@ -0,0 +1,9 @@
+{
+  "keys": {
+    "development": {
+      "vladimir": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ3DUNjSOe4NHpbJFMCn7AAmM39vrtNQ0BsoB0ttziBI vladimirs.kovalovs@L0854"
+    },
+    "preproduction": {},
+    "production": {}
+  }
+}