This module will generate a bastion host vm compatible with OS Login and IAP Tunneling that can be used to access internal VMs.

This module will:

• Create a dedicated service account for the bastion host
• Create a GCE instance to be the bastion host
• Create a firewall rule to allow TCP:22 SSH access from the IAP to the bastion
• Necessary IAM bindings to allow IAP and OS Logins from specified members

Basic usage of this module is as follows:

module "iap_bastion" {
  source = "terraform-google-modules/bastion-host/google"

  project = var.project
  zone    = var.zone
  network = google_compute_network.net.self_link
  subnet  = google_compute_subnetwork.net.self_link
  members = [
    "group:[email protected]",
    "user:[email protected]",
  ]
}

Functional example is included in the examples directory.

These sections describe requirements for using this module.

The following dependencies must be available:

• Terraform >= v0.12
• Terraform Provider for GCP

A project with the following APIs enabled must be used to host the resources of this module:

• Google Cloud Storage JSON API: storage-api.googleapis.com
• Compute Engine API: compute.googleapis.com
• Cloud Identity-Aware Proxy API: iap.googleapis.com
• OS Login API: oslogin.googleapis.com

The Project Factory module can be used to provision a project with the necessary APIs enabled.

This module only sets up permissions for the bastion service account, not the users who need access. To allow access, grant one of the following instance access roles.

• roles/compute.osLogin Does not grant administrator permissions
• roles/compute.osAdminLogin Grants administrator permissions.

If the user does not share the same domain as the org the bastion is in, you will also need to grant that user roles/compute.osLoginExternalUser. This is to prevent external SSH access from being granted at the project level. See the OS Login documentation for more information.

list(object({
    network_tier           = string
    nat_ip                 = string
    public_ptr_domain_name = string
  }))

[
  {
    "nat_ip": "",
    "network_tier": "PREMIUM",
    "public_ptr_domain_name": ""
  }
]

list(object({
    network            = string
    subnetwork         = string
    subnetwork_project = string
    network_ip         = string
    nic_type           = string
    stack_type         = string
    queue_count        = number
    access_config = list(object({
      nat_ip       = string
      network_tier = string
    }))
    ipv6_access_config = list(object({
      network_tier = string
    }))
    alias_ip_range = list(object({
      ip_cidr_range         = string
      subnetwork_range_name = string
    }))
  }))

[
  "cloud-platform"
]

[
  "roles/logging.logWriter",
  "roles/monitoring.metricWriter",
  "roles/monitoring.viewer",
  "roles/compute.osLogin"
]

Refer to the contribution guidelines for information on contributing to this module.