A Terraform module for creating a resilient AWS bastion host with SSH keys managed from an S3 bucket.
tf_aws_bastion_s3_keys is a Terraform module that automates the provisioning of a secure, resilient bastion host on AWS. It solves the problem of managing SSH access at scale by dynamically syncing authorized keys from an S3 bucket, ensuring centralized control and eliminating manual key distribution.
DevOps engineers, SREs, and cloud infrastructure teams managing AWS environments who need a secure, automated bastion host solution with centralized SSH key management.
Developers choose this module for its production-ready design, built-in high availability via auto-scaling, and seamless integration with AWS S3 for key management, reducing operational overhead and enhancing security.
A Terraform module for creating bastion host on AWS EC2 and populate its ~/.ssh/authorized_keys with public keys from bucket
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Dynamically populates SSH authorized_keys from an S3 bucket, enabling admins to add or revoke access by updating the bucket, as described in the S3-based SSH Key Management feature.
Uses an auto-scaling group with min=max=desired=1 to ensure automatic instance replacement on failure, providing resilience without manual intervention, per the Auto-scaling Resilience focus.
Supports configurable CIDR ranges, IPv6 allow-lists, and security group integrations for precise SSH access, detailed in the Flexible Network Access section.
Allows injection of additional user-data scripts for security hardening or Elastic IP assignment, via the additional_user_data_script and eip inputs, enhancing adaptability.
Deeply integrated with AWS services like S3 and auto-scaling, making migration to other clouds cumbersome and limiting cross-platform flexibility.
Elastic IP assignment requires extra IAM permissions and custom user-data scripts, adding operational overhead compared to native AWS solutions, as noted in the example.
Designed exclusively for SSH access, which may not meet needs for RDP or other remote protocols, restricting its use in diverse environments.
Defaults to Ubuntu AMI and requires overriding user_data_file for other OSes, as indicated in the variables, potentially complicating deployments with custom images.