| additional_user_data_script |
Additional user data script to run on instance boot |
string |
"" |
no |
| allowed_public_ips |
List of public IPs or private IP (internal) of Software Defined Perimeter to allow SSH access from |
list(string) |
[] |
no |
| ami_canonical_owner |
Filter for AMI using this canonical owner ID |
string |
null |
no |
| ami_id |
ID of AMI to use for Bastion |
string |
"" |
no |
| ami_name_filter |
Filter for AMI using this name. Accepts wildcards |
string |
"" |
no |
| ami_virtualization_type |
Filter for AMI using this virtualization type |
string |
"" |
no |
| assign_public_ip |
Determines if an instance gets a public IP assigned at launch time |
bool |
false |
no |
| bastion_instance_tags |
A map of tags to add to the bastion instance |
map(string) |
{} |
no |
| bastion_secondary_ebs_volume_size |
value of the secondary EBS volume size in GB |
string |
"70" |
no |
| enable_bastion_terraform_permissions |
Enable Terraform permissions for Bastion |
bool |
false |
no |
| enable_log_to_cloudwatch |
Enable Session Manager to Log to CloudWatch Logs |
bool |
false |
no |
| enable_secondary_ebs_volume |
Enable the creation of a secondary EBS volume |
bool |
false |
no |
| eni_attachment_config |
Optional list of enis to attach to instance |
list(object({
network_interface_id = string
device_index = string
})) |
null |
no |
| instance_type |
Instance type to use for Bastion |
string |
"m5.large" |
no |
| max_ssh_sessions |
Maximum number of ssh connections that are allowed |
number |
1 |
no |
| max_ssm_connections |
Maximum number of simultaneous connections that SSM will allow |
number |
1 |
no |
| name |
Name of Bastion |
string |
n/a |
yes |
| permissions_boundary |
(Optional) The ARN of the policy that is used to set the permissions boundary for the role. |
string |
null |
no |
| policy_arns |
List of IAM policy ARNs to attach to the instance profile |
list(string) |
[] |
no |
| policy_content |
JSON IAM Policy body. Use this to add a custom policy to your instance profile (Optional) |
string |
null |
no |
| private_ip |
The private IP address to assign to the bastion |
string |
null |
no |
| region |
AWS Region |
string |
n/a |
yes |
| root_volume_config |
n/a |
object({
volume_type = any
volume_size = any
}) |
{
"volume_size": "20",
"volume_type": "gp3"
} |
no |
| secrets_manager_secret_id |
The ID of the Secrets Manager secret for the bastion to pull from for SSH access if SSM authentication is enabled, optional |
string |
"" |
no |
| security_group_ids |
List of security groups to associate with instance |
list(any) |
[] |
no |
| ssh_password |
Password for SSH access if SSM authentication is enabled, optional |
string |
"" |
no |
| ssh_user |
Username to use when accessing the instance using SSH |
string |
"ec2-user" |
no |
| ssm_enabled |
Enable SSM agent |
bool |
true |
no |
| subnet_id |
IDs of subnets to deploy the instance in |
string |
"" |
no |
| subnet_name |
Names of subnets to deploy the instance in |
string |
"" |
no |
| tags |
A map of tags to add to all resources |
map(string) |
{} |
no |
| tenancy |
The tenancy of the instance (if the instance is running in a VPC). Valid values are 'default' or 'dedicated'. |
string |
"default" |
no |
| terminate_oldest_ssm_connection_first |
Determines how the SSM connections will be terminated. If true then oldest connection will terminate first. Defaults to false |
bool |
false |
no |
| uds_cli_version |
The version of UDS CLI to use |
string |
"v0.11.0" |
no |
| user_data_override |
Override the default module user data with your own. This will disable the default user data and use your own. |
string |
null |
no |
| vpc_id |
VPC id |
string |
n/a |
yes |
| zarf_version |
The version of Zarf to use |
string |
"" |
no |