Merge pull request #26 from DNXLabs/ssh_key_pair

Optionally, private key can be generated to connect to ec2 of ecs nodes

Author: jrpradojr

_outputs.tf

@@ -97,3 +97,7 @@ output "alb_secgrp_id" {
 output "efs_fs_id" {
   value = try(aws_efs_file_system.ecs[0].id, "")
 }
+
+output "private_key_pem" {
+  value = try(tls_private_key.algorithm[0].private_key_pem, "")
+}

_variables.tf

@@ -289,3 +289,13 @@ variable "fargate_only" {
   default     = false
   description = "Enable when cluster is only for fargate and does not require ASG/EC2/EFS infrastructure"
 }
+
+variable "ec2_key_enabled" {
+  default     = false
+  description = "Generate a SSH private key and include in launch template of ECS nodes"
+}
+
+variable "vpn_cidr" {
+  default     = ["10.37.0.0/16"]
+  description = "Cidr of VPN to grant ssh access to ECS nodes"
+}

ec2-launch-template.tf

@@ -33,7 +33,21 @@ resource "aws_launch_template" "ecs" {
 
   user_data = base64encode(data.template_file.userdata[0].rendered)
 
+  key_name = var.ec2_key_enabled ? aws_key_pair.generated_key[0].key_name : null
+
   lifecycle {
     create_before_destroy = true
   }
 }
+
+resource "tls_private_key" "algorithm" {
+  count     = var.ec2_key_enabled ? 1 : 0
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "aws_key_pair" "generated_key" {
+  count      = var.ec2_key_enabled ? 1 : 0
+  key_name   = "${var.name}-key"
+  public_key = tls_private_key.algorithm[0].public_key_openssh
+}

sg-ecs-nodes.tf

@@ -32,6 +32,18 @@ resource "aws_security_group_rule" "all_from_alb_internal_to_ecs_nodes" {
   source_security_group_id = aws_security_group.alb_internal[0].id
 }
 
+resource "aws_security_group_rule" "ssh_from_vpn_to_ecs_nodes" {
+  count = var.ec2_key_enabled ? 1 : 0
+
+  description       = "ssh from VPN"
+  type              = "ingress"
+  from_port         = 22
+  to_port           = 22
+  protocol          = "tcp"
+  cidr_blocks       = var.vpn_cidr
+  security_group_id = aws_security_group.ecs_nodes.id
+}
+
 resource "aws_security_group_rule" "all_from_ecs_nodes_to_ecs_nodes" {
   description              = "Traffic between ECS nodes"
   type                     = "ingress"