A Terraform module to deploy a stateless, containerized SSH bastion service on AWS with IAM-based authentication.
Terraform AWS SSH Bastion Service is a Terraform module that deploys a secure, stateless SSH bastion service on AWS. It replaces traditional long-lived bastion hosts with ephemeral Docker containers that authenticate users via AWS IAM, allowing developers to use their IAM credentials and managed SSH keys for access. The service automatically scales and provides high availability through an Auto Scaling Group and Network Load Balancer.
DevOps engineers, SREs, and cloud architects managing AWS infrastructure who need secure, auditable SSH access to private resources without managing static bastion hosts or distributing SSH keys manually.
Developers choose this module because it integrates seamlessly with AWS IAM for authentication, eliminates the operational overhead of bastion host maintenance, and enhances security through ephemeral, containerized sessions. It is highly customizable, supports cross-account access, and is entirely self-contained with no external dependencies.
Terraform plan to deploy ssh bastion as a containerised, stateless service on AWS with IAM based authentication
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Integrates with AWS IAM for user authentication and SSH key management via the AWS console, eliminating manual key distribution as highlighted in the README.
Spawns a new Ubuntu container per SSH connection, destroyed on disconnect or after 12 hours, ensuring no persistent state and reducing attack surfaces.
Uses a Network Load Balancer and Auto Scaling Group for resilience, automatically scaling instances to handle demand fluctuations.
Supports assuming IAM roles in other AWS accounts with provided sample policies, enabling centralized identity management for multi-account setups.
Allows custom AMIs, userdata sections, security groups, and service ports, offering flexibility for advanced use cases documented in examples.
Unrestricted incoming traffic can trigger AWS IAM rate limiting due to frequent identity queries, potentially causing denial of service without proper whitelisting.
Requires systemd version 229+ for RunTimeMaxSec, making it incompatible with older AMIs like Amazon Linux 2 and limiting deployment options.
Replacing default userdata sections or AMIs requires deep understanding of systemd and Docker dependencies, increasing initial configuration complexity.
Client IP addresses are not visible in logs per issue 45, and logging relies on the host journal, which may not suffice for fine-grained auditing needs.