Added possibility to specify allowed IPv6 CIDR blocks

CHANGELOG.md

@@ -1,8 +1,14 @@
+## 1.2.4
+
+FEATURES:
+
+ * [GH-30] - Added possibility to specify IPv6 CIDR blocks to allow SSH access (antonbabenko)
+
 ## 1.2.3
 
 FEATURES:
 
- * [GH-29] - Added Ability to pass a list of security groups to allow SSH access (tfhartmann)
+ * [GH-29] - Added ability to pass a list of security groups to allow SSH access (tfhartmann)
 
 ## 1.2.2
 

README.md

@@ -26,7 +26,8 @@ Only SSH access is allowed to the bastion host.
   * `associate_public_ip_address` - Whether to auto-assign public IP to the instance (by default - `false`)
   * `eip` - EIP to put into EC2 tag (can be used with scripts like https://github.com/skymill/aws-ec2-assign-elastic-ip, default - empty value)
   * `key_name` - Launch configuration key name to be applied to created instance(s).
-  * `allowed_cidr` - A list of CIDR Networks to allow ssh access to. Defaults to 0.0.0.0/0
+  * `allowed_cidr` - A list of CIDR Networks to allow ssh access to. Defaults to "0.0.0.0/0"
+  * `allowed_ipv6_cidr` - A list of IPv6 CIDR Networks to allow ssh access to. Defaults to "::/0"
   * `allowed_security_groups` - A list of Security Group ID's to allow access to the bastion host (useful if bastion is deployed internally) Defaults to empty list
 
 ## Outputs:

main.tf

@@ -14,6 +14,7 @@ resource "aws_security_group_rule" "ssh_ingress" {
   to_port           = "22"
   protocol          = "tcp"
   cidr_blocks       = "${var.allowed_cidr}"
+  ipv6_cidr_blocks  = "${var.allowed_ipv6_cidr}"
   security_group_id = "${aws_security_group.bastion.id}"
 }
 
@@ -33,6 +34,7 @@ resource "aws_security_group_rule" "bastion_all_egress" {
   to_port           = "65535"
   protocol          = "all"
   cidr_blocks       = ["0.0.0.0/0"]
+  ipv6_cidr_blocks  = ["::/0"]
   security_group_id = "${aws_security_group.bastion.id}"
 }
 

variables.tf

@@ -4,6 +4,12 @@ variable "allowed_cidr" {
   description = "A list of CIDR Networks to allow ssh access to."
 }
 
+variable "allowed_ipv6_cidr" {
+  type        = "list"
+  default     = ["::/0"]
+  description = "A list of IPv6 CIDR Networks to allow ssh access to."
+}
+
 variable "allowed_security_groups" {
   type        = "list"
   default     = []