feat: add bastion configuration to terraform

Added a terraform configuration to allow the creation of a bastion host for remote access and
management of the OpenSearch cluster.

README.md

@@ -123,6 +123,10 @@ The project is split into four main Terraform configurations:
   allow access to GitHub Action for specific repositories and operations. **This applies to both
   dev and prod environments**. You can switch between workspaces (as mentioned earlier) to deploy
   infrastructure in either the dev or prod account.
+- [22-bastion][app]: Configures a bastion host for secure remote access and management of the
+  OpenSearch cluster. **This applies to both dev and prod environments**. You can switch
+  between workspaces (as mentioned earlier) to deploy infrastructure in either the dev or prod
+  account.
 
 ### System Flow Overview
 

pillarbox-monitoring-terraform/20-pillarbox-monitoring-app/iam.tf

@@ -167,7 +167,7 @@ data "aws_iam_policy_document" "opensearch_policy" {
 
     actions = ["es:*"]
     resources = [
-      "arn:aws:es:${data.aws_region.current.name}:${local.accout_id}:domain/${local.opensearch.domain_name}/*"
+      "arn:aws:es:${data.aws_region.current.name}:${local.account_id}:domain/${local.opensearch.domain_name}/*"
     ]
   }
 }

pillarbox-monitoring-terraform/20-pillarbox-monitoring-app/locals.tf

@@ -1,5 +1,5 @@
 locals {
-  accout_id        = var.account_ids[terraform.workspace]
+  account_id       = var.account_ids[terraform.workspace]
   vpc_id           = var.vpc_ids[terraform.workspace]
   ecs_cluster_name = "${var.application_name}-cluster"
   is_prod          = terraform.workspace == "prod"

pillarbox-monitoring-terraform/20-pillarbox-monitoring-app/main.tf

@@ -26,7 +26,7 @@ terraform {
 # -----------------------------------
 
 provider "aws" {
-  allowed_account_ids = [local.accout_id]
+  allowed_account_ids = [local.account_id]
 
   # Apply default tags to all AWS resources
   default_tags {

pillarbox-monitoring-terraform/20-pillarbox-monitoring-app/opensearch.tf

@@ -4,7 +4,7 @@
 
 resource "aws_opensearch_domain" "opensearch_domain" {
   domain_name    = local.opensearch.domain_name
-  engine_version = "OpenSearch_2.15"
+  engine_version = "OpenSearch_2.17"
 
   # Cluster configuration including instance type and count
   cluster_config {

pillarbox-monitoring-terraform/22-bastion/locals.tf

@@ -0,0 +1,13 @@
+locals {
+  bastion_ami           = "ami-0d7c381edfc5ee30e"
+  bastion_instance_type = "t4g.nano"
+  vpc_id                = var.vpc_ids[terraform.workspace]
+
+  default_tags = {
+    "srg-managed-by"    = "terraform"
+    "srg-application"   = var.application_name
+    "srg-owner"         = "[email protected]"
+    "srg-businessowner" = "pillarbox"
+    "srg-environment"   = terraform.workspace
+  }
+}

pillarbox-monitoring-terraform/22-bastion/main.tf

@@ -0,0 +1,128 @@
+# -----------------------------------
+# Terraform Configuration
+# -----------------------------------
+
+terraform {
+  # Backend configuration for storing the Terraform state in S3 with DynamoDB table for state locking
+  backend "s3" {
+    encrypt        = true
+    bucket         = "pillarbox-monitoring-tfstate"
+    key            = "terraform/22-bastion/terraform.tfstate"
+    dynamodb_table = "pillarbox-monitoring-terraform-statelock"
+    profile        = "prod"
+  }
+
+  # Specify required providers and their versions
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~>5.4.0"
+    }
+  }
+}
+
+# -----------------------------------
+# AWS Provider Setup
+# -----------------------------------
+
+provider "aws" {
+  # Apply default tags to all AWS resources
+  default_tags {
+    tags = local.default_tags
+  }
+}
+
+# -----------------------------------
+# AWS Data Sources
+# -----------------------------------
+
+# Retrieve the VPC information
+data "aws_vpc" "main_vpc" {
+  id = local.vpc_id
+}
+
+# Retrieve public subnets based on VPC and tags
+data "aws_subnets" "public_subnets" {
+  filter {
+    name   = "vpc-id"
+    values = [data.aws_vpc.main_vpc.id]
+  }
+
+  tags = {
+    Name = "*public*"
+  }
+}
+
+# -----------------------------------
+# Bastion configuration
+# -----------------------------------
+
+resource "aws_key_pair" "bastion_key" {
+  key_name   = "bastion-keypair"
+  public_key = var.bastion_public_key
+}
+
+# Security Group for the Bastion Host
+resource "aws_security_group" "bastion_sg" {
+  name        = "bastion-sg"
+  description = "Allow SSH access by IP"
+  vpc_id      = data.aws_vpc.main_vpc.id
+
+  ingress {
+    description = "SSH from my IP"
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = var.allowed_ips
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = var.allowed_ips
+  }
+}
+
+# Bastion Host EC2 Instance in Public Subnet
+resource "aws_instance" "bastion" {
+  ami                         = local.bastion_ami
+  instance_type               = local.bastion_instance_type
+  subnet_id                   = data.aws_subnets.public_subnets.ids[0]
+  key_name                    = "bastion-keypair"
+  vpc_security_group_ids      = [aws_security_group.bastion_sg.id]
+  associate_public_ip_address = true
+
+  tags = {
+    Name = "bastion-host"
+  }
+}
+
+# -----------------------------------
+# OpenSearch security group rule
+# -----------------------------------
+
+data "aws_security_group" "opensearch_sg" {
+  filter {
+    name   = "group-name"
+    values = ["opensearch-sg"]
+  }
+}
+
+resource "aws_security_group_rule" "new_ingress" {
+  type                     = "ingress"
+  from_port                = 443
+  to_port                  = 443
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.bastion_sg.id
+  security_group_id        = data.aws_security_group.opensearch_sg.id
+}
+
+# -----------------------------------
+# Outputs
+# -----------------------------------
+
+output "bastion_public_ip" {
+  description = "Public IP of the Bastion Host"
+  value       = aws_instance.bastion.public_ip
+}

pillarbox-monitoring-terraform/22-bastion/variables.tf

@@ -0,0 +1,21 @@
+variable "application_name" {
+  description = "The name of the application"
+  type        = string
+  default     = "pillarbox-monitoring"
+}
+
+variable "vpc_ids" {
+  description = "VPC id map by terraform workspace"
+  type        = map(string)
+}
+
+# Variable for Public Key
+variable "bastion_public_key" {
+  description = "Public key for the bastion host"
+  type        = string
+}
+
+variable "allowed_ips" {
+  description = "The list of ips that are allowed to connect to the bastion"
+  type        = list(string)
+}