Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 68edef8

Browse files
luigidifraiaworkbryantbiggs
andauthored
feat: Add example for connecting via Session Manager without Internet access (#336)
Co-authored-by: Bryant Biggs <bryantbiggs@gmail.com>
1 parent 376fba8 commit 68edef8

File tree

10 files changed

+293
-4
lines changed

10 files changed

+293
-4
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.81.0
3+
rev: v1.83.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_wrapper_module_for_each

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ Users of Terragrunt can achieve similar results by using modules provided in the
8484
## Examples
8585

8686
- [Complete EC2 instance](https://github.com/terraform-aws-modules/terraform-aws-ec2-instance/tree/master/examples/complete)
87+
- [EC2 instance w/ private network access via Session Manager](https://github.com/terraform-aws-modules/terraform-aws-ec2-instance/tree/master/examples/session-manager)
8788
- [EC2 instance with EBS volume attachment](https://github.com/terraform-aws-modules/terraform-aws-ec2-instance/tree/master/examples/volume-attachment)
8889

8990
## Make an encrypted AMI for use

‎examples/complete/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,7 @@ resource "aws_ec2_capacity_reservation" "targeted" {
359359
################################################################################
360360
# EC2 Module - CPU Options
361361
################################################################################
362+
362363
module "ec2_cpu_options" {
363364
source = "../../"
364365

‎examples/session-manager/README.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# EC2 instance w/ private network access via Session Manager
2+
3+
The configuration in this directory creates an EC2 instance not connected to the Internet that can be accessed using Session Manager through VPC Endpoints.
4+
5+
This example outputs instance id, ARN, state, and tags.
6+
7+
## Usage
8+
9+
To run this example you need to execute:
10+
11+
```bash
12+
$ terraform init
13+
$ terraform plan
14+
$ terraform apply
15+
```
16+
17+
You can verify that SSM is setup correctly by connecting to the instance. The example output provides the AWS CLI command to connect to the instance under the output `ssm_connect_command` which will look like:
18+
19+
```bash
20+
aws ssm start-session --target <INSTANCE-ID> --region <REGION>
21+
```
22+
23+
You will need to have the Session Manager plugin for the AWS CLI installed to execute the command. Instructions for installing can be found [here](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html).
24+
25+
Note that this example may create resources which can cost money. Run `terraform destroy` when you don't need these resources.
26+
27+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
28+
## Requirements
29+
30+
| Name | Version |
31+
|------|---------|
32+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
33+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.66 |
34+
35+
## Providers
36+
37+
| Name | Version |
38+
|------|---------|
39+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.66 |
40+
41+
## Modules
42+
43+
| Name | Source | Version |
44+
|------|--------|---------|
45+
| <a name="module_ec2"></a> [ec2](#module\_ec2) | ../../ | n/a |
46+
| <a name="module_security_group_instance"></a> [security\_group\_instance](#module\_security\_group\_instance) | terraform-aws-modules/security-group/aws | ~> 5.0 |
47+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
48+
| <a name="module_vpc_endpoints"></a> [vpc\_endpoints](#module\_vpc\_endpoints) | terraform-aws-modules/vpc/aws//modules/vpc-endpoints | ~> 5.0 |
49+
50+
## Resources
51+
52+
| Name | Type |
53+
|------|------|
54+
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
55+
56+
## Inputs
57+
58+
No inputs.
59+
60+
## Outputs
61+
62+
| Name | Description |
63+
|------|-------------|
64+
| <a name="output_ec2_arn"></a> [ec2\_arn](#output\_ec2\_arn) | The ARN of the instance |
65+
| <a name="output_ec2_capacity_reservation_specification"></a> [ec2\_capacity\_reservation\_specification](#output\_ec2\_capacity\_reservation\_specification) | Capacity reservation specification of the instance |
66+
| <a name="output_ec2_ebs_block_device"></a> [ec2\_ebs\_block\_device](#output\_ec2\_ebs\_block\_device) | EBS block device information |
67+
| <a name="output_ec2_ephemeral_block_device"></a> [ec2\_ephemeral\_block\_device](#output\_ec2\_ephemeral\_block\_device) | Ephemeral block device information |
68+
| <a name="output_ec2_iam_instance_profile_arn"></a> [ec2\_iam\_instance\_profile\_arn](#output\_ec2\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
69+
| <a name="output_ec2_iam_instance_profile_id"></a> [ec2\_iam\_instance\_profile\_id](#output\_ec2\_iam\_instance\_profile\_id) | Instance profile's ID |
70+
| <a name="output_ec2_iam_instance_profile_unique"></a> [ec2\_iam\_instance\_profile\_unique](#output\_ec2\_iam\_instance\_profile\_unique) | Stable and unique string identifying the IAM instance profile |
71+
| <a name="output_ec2_iam_role_arn"></a> [ec2\_iam\_role\_arn](#output\_ec2\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
72+
| <a name="output_ec2_iam_role_name"></a> [ec2\_iam\_role\_name](#output\_ec2\_iam\_role\_name) | The name of the IAM role |
73+
| <a name="output_ec2_iam_role_unique_id"></a> [ec2\_iam\_role\_unique\_id](#output\_ec2\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
74+
| <a name="output_ec2_id"></a> [ec2\_id](#output\_ec2\_id) | The ID of the instance |
75+
| <a name="output_ec2_instance_state"></a> [ec2\_instance\_state](#output\_ec2\_instance\_state) | The state of the instance. One of: `pending`, `running`, `shutting-down`, `terminated`, `stopping`, `stopped` |
76+
| <a name="output_ec2_primary_network_interface_id"></a> [ec2\_primary\_network\_interface\_id](#output\_ec2\_primary\_network\_interface\_id) | The ID of the instance's primary network interface |
77+
| <a name="output_ec2_private_dns"></a> [ec2\_private\_dns](#output\_ec2\_private\_dns) | The private DNS name assigned to the instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC |
78+
| <a name="output_ec2_public_dns"></a> [ec2\_public\_dns](#output\_ec2\_public\_dns) | The public DNS name assigned to the instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC |
79+
| <a name="output_ec2_public_ip"></a> [ec2\_public\_ip](#output\_ec2\_public\_ip) | The public IP address assigned to the instance, if applicable. NOTE: If you are using an aws\_eip with your instance, you should refer to the EIP's address directly and not use `public_ip` as this field will change after the EIP is attached |
80+
| <a name="output_ec2_root_block_device"></a> [ec2\_root\_block\_device](#output\_ec2\_root\_block\_device) | Root block device information |
81+
| <a name="output_ec2_tags_all"></a> [ec2\_tags\_all](#output\_ec2\_tags\_all) | A map of tags assigned to the resource, including those inherited from the provider default\_tags configuration block |
82+
| <a name="output_ssm_connect_command"></a> [ssm\_connect\_command](#output\_ssm\_connect\_command) | The AWS CLI command to connect to the instance using Session Manager |
83+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/session-manager/main.tf

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
provider "aws" {
2+
region = local.region
3+
}
4+
5+
data "aws_availability_zones" "available" {}
6+
7+
locals {
8+
name = "ex-${basename(path.cwd)}"
9+
region = "eu-west-1"
10+
11+
vpc_cidr = "10.0.0.0/16"
12+
azs = slice(data.aws_availability_zones.available.names, 0, 3)
13+
14+
tags = {
15+
Name = local.name
16+
Example = local.name
17+
Repository = "https://github.com/terraform-aws-modules/terraform-aws-ec2-instance"
18+
}
19+
}
20+
21+
################################################################################
22+
# EC2 Module
23+
################################################################################
24+
25+
module "ec2" {
26+
source = "../../"
27+
28+
name = local.name
29+
30+
subnet_id = element(module.vpc.intra_subnets, 0)
31+
vpc_security_group_ids = [module.security_group_instance.security_group_id]
32+
33+
create_iam_instance_profile = true
34+
iam_role_description = "IAM role for EC2 instance"
35+
iam_role_policies = {
36+
AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
37+
}
38+
39+
tags = local.tags
40+
}
41+
42+
################################################################################
43+
# Supporting Resources
44+
################################################################################
45+
46+
module "vpc" {
47+
source = "terraform-aws-modules/vpc/aws"
48+
version = "~> 5.0"
49+
50+
name = local.name
51+
cidr = local.vpc_cidr
52+
53+
azs = local.azs
54+
intra_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
55+
56+
tags = local.tags
57+
}
58+
59+
module "security_group_instance" {
60+
source = "terraform-aws-modules/security-group/aws"
61+
version = "~> 5.0"
62+
63+
name = "${local.name}-ec2"
64+
description = "Security Group for EC2 Instance Egress"
65+
66+
vpc_id = module.vpc.vpc_id
67+
68+
egress_rules = ["https-443-tcp"]
69+
70+
tags = local.tags
71+
}
72+
73+
module "vpc_endpoints" {
74+
source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"
75+
version = "~> 5.0"
76+
77+
vpc_id = module.vpc.vpc_id
78+
79+
endpoints = { for service in toset(["ssm", "ssmmessages", "ec2messages"]) :
80+
replace(service, ".", "_") =>
81+
{
82+
service = service
83+
subnet_ids = module.vpc.intra_subnets
84+
private_dns_enabled = true
85+
tags = { Name = "${local.name}-${service}" }
86+
}
87+
}
88+
89+
create_security_group = true
90+
security_group_name_prefix = "${local.name}-vpc-endpoints-"
91+
security_group_description = "VPC endpoint security group"
92+
security_group_rules = {
93+
ingress_https = {
94+
description = "HTTPS from subnets"
95+
cidr_blocks = module.vpc.intra_subnets_cidr_blocks
96+
}
97+
}
98+
99+
tags = local.tags
100+
}

‎examples/session-manager/outputs.tf

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
output "ec2_id" {
2+
description = "The ID of the instance"
3+
value = module.ec2.id
4+
}
5+
6+
output "ec2_arn" {
7+
description = "The ARN of the instance"
8+
value = module.ec2.arn
9+
}
10+
11+
output "ec2_capacity_reservation_specification" {
12+
description = "Capacity reservation specification of the instance"
13+
value = module.ec2.capacity_reservation_specification
14+
}
15+
16+
output "ec2_instance_state" {
17+
description = "The state of the instance. One of: `pending`, `running`, `shutting-down`, `terminated`, `stopping`, `stopped`"
18+
value = module.ec2.instance_state
19+
}
20+
21+
output "ec2_primary_network_interface_id" {
22+
description = "The ID of the instance's primary network interface"
23+
value = module.ec2.primary_network_interface_id
24+
}
25+
26+
output "ec2_private_dns" {
27+
description = "The private DNS name assigned to the instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC"
28+
value = module.ec2.private_dns
29+
}
30+
31+
output "ec2_public_dns" {
32+
description = "The public DNS name assigned to the instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC"
33+
value = module.ec2.public_dns
34+
}
35+
36+
output "ec2_public_ip" {
37+
description = "The public IP address assigned to the instance, if applicable. NOTE: If you are using an aws_eip with your instance, you should refer to the EIP's address directly and not use `public_ip` as this field will change after the EIP is attached"
38+
value = module.ec2.public_ip
39+
}
40+
41+
output "ec2_tags_all" {
42+
description = "A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block"
43+
value = module.ec2.tags_all
44+
}
45+
46+
output "ec2_iam_role_name" {
47+
description = "The name of the IAM role"
48+
value = module.ec2.iam_role_name
49+
}
50+
51+
output "ec2_iam_role_arn" {
52+
description = "The Amazon Resource Name (ARN) specifying the IAM role"
53+
value = module.ec2.iam_role_arn
54+
}
55+
56+
output "ec2_iam_role_unique_id" {
57+
description = "Stable and unique string identifying the IAM role"
58+
value = module.ec2.iam_role_unique_id
59+
}
60+
61+
output "ec2_iam_instance_profile_arn" {
62+
description = "ARN assigned by AWS to the instance profile"
63+
value = module.ec2.iam_instance_profile_arn
64+
}
65+
66+
output "ec2_iam_instance_profile_id" {
67+
description = "Instance profile's ID"
68+
value = module.ec2.iam_instance_profile_id
69+
}
70+
71+
output "ec2_iam_instance_profile_unique" {
72+
description = "Stable and unique string identifying the IAM instance profile"
73+
value = module.ec2.iam_instance_profile_unique
74+
}
75+
76+
output "ec2_root_block_device" {
77+
description = "Root block device information"
78+
value = module.ec2.root_block_device
79+
}
80+
81+
output "ec2_ebs_block_device" {
82+
description = "EBS block device information"
83+
value = module.ec2.ebs_block_device
84+
}
85+
86+
output "ec2_ephemeral_block_device" {
87+
description = "Ephemeral block device information"
88+
value = module.ec2.ephemeral_block_device
89+
}
90+
91+
output "ssm_connect_command" {
92+
description = "The AWS CLI command to connect to the instance using Session Manager"
93+
value = "aws ssm start-session --target ${module.ec2.id} --region ${local.region}"
94+
}

‎examples/session-manager/variables.tf

Whitespace-only changes.

‎examples/session-manager/versions.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.66"
8+
}
9+
}
10+
}

‎examples/volume-attachment/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ Note that this example may create resources which can cost money. Run `terraform
2222
| Name | Version |
2323
|------|---------|
2424
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
25-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.20 |
25+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.66 |
2626

2727
## Providers
2828

2929
| Name | Version |
3030
|------|---------|
31-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.20 |
31+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.66 |
3232

3333
## Modules
3434

‎examples/volume-attachment/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 4.20"
7+
version = ">= 4.66"
88
}
99
}
1010
}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /