Skip to content

Latest commit

 

History

History
78 lines (68 loc) · 9.04 KB

README.md

File metadata and controls

78 lines (68 loc) · 9.04 KB
Raw

ibmcloud-mzr-lab

Terraform code to deploy an IBM Cloud MZR VPC with a VPN or Bastion host. This is a work in progress and currently creates:

  • ✅ MZR VPC
  • ✅ Public Gateway per zone for Frontend subnets
  • ✅ Frontend subnet per zone
  • ✅ Frontend Security Group for SSH, Web, and VPN
    • Inbound: 80/tcp, 443/tcp, 22/tcp, 51280/udp
    • Outbound: all
  • ✅ Cloud Object Storage instance for flowlogs (target existing or create new)
  • ✅ IAM Authorization policy so that Flowlogs can write to the COS instance.
  • ✅ COS bucket for each Frontend subnet
  • ✅ Flowlogs collector for each Frontend subnet
  • ✅ Logging instance with ability to use existing instance or deploy new one
  • ❌ VPN server with Wireguard
  • ✅ Bastion Server

Modules

Name Source Version
cos git::https://github.com/terraform-ibm-modules/terraform-ibm-cos v5.3.1
fowlogs_cos_bucket git::https://github.com/terraform-ibm-modules/terraform-ibm-cos v5.3.1
logging git::https://github.com/terraform-ibm-modules/terraform-ibm-observability-instances main
resource_group git::https://github.com/terraform-ibm-modules/terraform-ibm-resource-group.git v1.0.5
security_group terraform-ibm-modules/vpc/ibm//modules/security-group 1.1.1
vpc terraform-ibm-modules/vpc/ibm//modules/vpc 1.1.1

Resources

Name Type
ibm_iam_authorization_policy.cos_flowlogs resource
ibm_is_floating_ip.bastion resource
ibm_is_flow_log.frontend resource
ibm_is_instance.bastion resource
ibm_is_ssh_key.generated_key resource
null_resource.create_private_key resource
random_shuffle.region resource
random_string.prefix resource
tls_private_key.ssh resource
ibm_is_image.base data source
ibm_is_ssh_key.sshkey data source
ibm_is_zones.regional data source
ibm_resource_instance.cos data source

Inputs

Name Description Type Default Required
allow_ip_spoofing Allow IP spoofing on the bastion instance primary interface. bool false no
classic_access Allow classic access to the VPC. bool false no
default_address_prefix The address prefix to use for the VPC. Default is set to auto. string "auto" no
existing_cos_instance The name of an existing COS instance to use. If not specified, a new instance will be created. string "" no
existing_resource_group Resource group to use for all deployed resources. If not specified, a new one will be created. string n/a yes
existing_ssh_key The name of an existing SSH key to use. If not specified, a new key will be created. string "" no
frontend_rules A list of security group rules to be added to the Frontend security group 
list(
    object({
      name      = string
      direction = string
      remote    = string
      tcp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      udp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      icmp = optional(
        object({
          type = optional(number)
          code = optional(number)
        })
      )
    })
  )
 
[
  {
    "direction": "inbound",
    "ip_version": "ipv4",
    "name": "inbound-vpn-udp",
    "remote": "0.0.0.0/0",
    "udp": {
      "port_max": 51280,
      "port_min": 51280
    }
  },
  {
    "direction": "inbound",
    "ip_version": "ipv4",
    "name": "inbound-http",
    "remote": "0.0.0.0/0",
    "tcp": {
      "port_max": 80,
      "port_min": 80
    }
  },
  {
    "direction": "inbound",
    "ip_version": "ipv4",
    "name": "inbound-https",
    "remote": "0.0.0.0/0",
    "tcp": {
      "port_max": 443,
      "port_min": 443
    }
  },
  {
    "direction": "inbound",
    "ip_version": "ipv4",
    "name": "inbound-ssh",
    "remote": "0.0.0.0/0",
    "tcp": {
      "port_max": 22,
      "port_min": 22
    }
  },
  {
    "direction": "inbound",
    "icmp": {
      "code": 0,
      "type": 8
    },
    "ip_version": "ipv4",
    "name": "inbound-icmp",
    "remote": "0.0.0.0/0"
  },
  {
    "direction": "outbound",
    "ip_version": "ipv4",
    "name": "all-outbound",
    "remote": "0.0.0.0/0"
  }
]
 no
image_name The name of an existing OS image to use. You can list available images with the command 'ibmcloud is images'. string "ibm-ubuntu-22-04-1-minimal-amd64-3" no
instance_profile The name of an existing instance profile to use. You can list available instance profiles with the command 'ibmcloud is instance-profiles'. string "cx2-2x4" no
metadata_service_enabled Enable the metadata service on the bastion instance. bool true no
owner Project owner or identifier. This is used as a tag on all supported resources. string n/a yes
project_prefix Prefix to be added to all deployed resources. If none provided, one will be automatically generated. string n/a yes
region IBM Cloud Region where resources will be deployed. If not specified, one will be randomly selected. To see available regions, run 'ibmcloud is regions'. string n/a yes

Outputs

Name Description
bastion_public_ip Public IP of the bastion instance.
cos_bucket_names n/a
cos_instance_guid The details of the COS instance.
frontend_subnet_ids The IDs of the frontend subnets.
public_gateway_ids The IDs of the public gateways.
region IBM Cloud Region where resources are deployed.
vpc_id The ID of the VPC.