Description: Terraform module to create a VPC's with private subnets, SSM session manager and ec2 for each region.

• EC2 can be accessed via SSM session manager.
• EC2 can ping each other via private IP.

Let's get started

Clone the repository
Edit provider.tf file and adjust region

Add credentials to github actions secrets/variables: secres: :

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• TFSTATE_BUCKET variables:
• TFSTATE_KEY
• TFSTATE_REGION

Export variables for terraform s3 backend (need to create s3 bucket for terraform state)

export TFSTATE_BUCKET="terraform-state-example"
export TFSTATE_KEY="terraform.tfstate"
export TFSTATE_REGION="eu-west-1"

Run terraform init with backend configuration

terraform init \
-backend-config="bucket=${TFSTATE_BUCKET}" \
-backend-config="key=${TFSTATE_KEY}" \
-backend-config="region=${TFSTATE_REGION}" 

Run terraform plan

terraform plan

Run terraform apply

terraform apply

Potential improvements:

• Set private kms key for ssm
• store log output for all sessions in s3 bucket
• VPC Network Firewall associated
• pre commit hooks (tflint, terraform fmt, terraform validate, terraform docs, security checks, etc)

Requirements

Name	Version
terraform	>= 1.0
aws	>= 1.0

Providers

Name	Version
aws	5.30.0
aws.peer	5.30.0

Modules

Name	Source	Version
region-1	./ssm-private-ec2	n/a
region-2	./ssm-private-ec2	n/a

Resources

Name	Type
aws_route.main	resource
aws_route.peer	resource
aws_vpc_peering_connection.peer	resource
aws_vpc_peering_connection_accepter.peer	resource
aws_caller_identity.peer	data source
aws_route_table.main	data source
aws_route_table.secondary	data source

Inputs

Name	Description	Type	Default	Required
region-1	Region 1	map	{ "region": "eu-west-1", "vpc_cidr": "10.0.0.0/16" }	no
region-2	Region 2	map	{ "region": "eu-west-2", "vpc_cidr": "10.1.0.0/16" }	no

Outputs

No outputs.

Reference: https://github.com/andrescueva/ssm-private-ec2