<commit_before>/**
 * The bastion host acts as the "jump point" for the rest of the infrastructure.
 * Since most of our instances aren't exposed to the external internet, the bastion acts as the gatekeeper for any direct SSH access.
 * The bastion is provisioned using the key name that you pass to the stack (and hopefully have stored somewhere).
 * If you ever need to access an instance directly, you can do it by "jumping through" the bastion.
 *
 *    $ terraform output # print the bastion ip
 *    $ ssh -i <path/to/key> ubuntu@<bastion-ip> ssh ubuntu@<internal-ip>
 *
 * Usage:
 *
 *    module "bastion" {
 *      source            = "github.com/segmentio/stack/bastion"
 *      region            = "us-west-2"
 *      vpc_id            = "vpc-12"
 *      key_name          = "ssh-key"
 *      subnet_id         = "pub-1"
 *      environment       = "prod"
 *      external_security_group = "sg-1"
 *    }
 *
 */

variable "environment" {
  description = "The environment, used for tagging, e.g prod"
}

variable "instance_type" {
  default     = "t2.micro"
  description = "Instance type, see a list at: https://aws.amazon.com/ec2/instance-types/"
}

variable "region" {
  description = "AWS Region, e.g us-west-2"
}

variable "vpc_id" {
  description = "VPC ID"
}

variable "key_name" {
  description = "The SSH key pair, key name"
}

variable "subnet_id" {
  description = "A external subnet id"
}

variable "stack_name" {
  description = "stack name to use as the value for the Terraform tag and in the security group name"
  default     = ""
}

variable "ami_id" {
  description = "ami id to use for the bastion host"
}

variable "external_security_group" {
  description = "Use this security group for external ssh access."
}

variable "cidr" {
  description = "The cidr block to use for internal security groups"
}

variable "private_ip" {
  description = "The private ip address to asssign to the bastion host"
  default = ""
}

/*
module "ami" {
  source        = "github.com/terraform-community-modules/tf_aws_ubuntu_ami/ebs"
  region        = "${var.region}"
  distribution  = "trusty"
  instance_type = "${var.instance_type}"
}
*/

resource "aws_security_group" "can-internal-ssh" {
  name        = "${format("%s-%s-can-internal-ssh", var.stack_name, var.environment)}"
  description = "Membership allows for ssh to other machines"
  vpc_id      = "${var.vpc_id}"

  lifecycle {
    create_before_destroy = true
  }

  tags {
    Name        = "${format("%s %s can internal ssh", var.stack_name, var.environment)}"
    Environment = "${var.environment}"
    Terraform   = "${var.stack_name}"
  }
}

resource "aws_instance" "bastion" {
  ami                    = "${var.ami_id}"
  source_dest_check      = false
  instance_type          = "${var.instance_type}"
  subnet_id              = "${var.subnet_id}"
  key_name               = "${var.key_name}"
  vpc_security_group_ids = ["${var.external_security_group}","${aws_security_group.can-internal-ssh.id}"]
  monitoring             = true
  user_data              = "${file(format("%s/user_data.sh", path.module))}"
  private_ip             = "${var.private_ip}"

  tags {
    Name        = "bastion ${var.environment}"
    Environment = "${var.environment}"
    Terraform   = "${var.stack_name}"
  }
}

resource "aws_eip" "bastion" {
  instance = "${aws_instance.bastion.id}"
  vpc      = true
}

// Bastion external IP address.
output "external_ip" {
  value = "${aws_eip.bastion.public_ip}"
}

output "internal_ip" {
  value = "${aws_eip.bastion.private_ip}"
}

output "instance_id" {
  value = "${aws_instance.bastion.id}"
}

output "can-internal-ssh" {
  value = "${aws_security_group.can-internal-ssh.id}"
}
<commit_msg>output bastion private ip when one is already given<commit_after>/**
 * The bastion host acts as the "jump point" for the rest of the infrastructure.
 * Since most of our instances aren't exposed to the external internet, the bastion acts as the gatekeeper for any direct SSH access.
 * The bastion is provisioned using the key name that you pass to the stack (and hopefully have stored somewhere).
 * If you ever need to access an instance directly, you can do it by "jumping through" the bastion.
 *
 *    $ terraform output # print the bastion ip
 *    $ ssh -i <path/to/key> ubuntu@<bastion-ip> ssh ubuntu@<internal-ip>
 *
 * Usage:
 *
 *    module "bastion" {
 *      source            = "github.com/segmentio/stack/bastion"
 *      region            = "us-west-2"
 *      vpc_id            = "vpc-12"
 *      key_name          = "ssh-key"
 *      subnet_id         = "pub-1"
 *      environment       = "prod"
 *      external_security_group = "sg-1"
 *    }
 *
 */

variable "environment" {
  description = "The environment, used for tagging, e.g prod"
}

variable "instance_type" {
  default     = "t2.micro"
  description = "Instance type, see a list at: https://aws.amazon.com/ec2/instance-types/"
}

variable "region" {
  description = "AWS Region, e.g us-west-2"
}

variable "vpc_id" {
  description = "VPC ID"
}

variable "key_name" {
  description = "The SSH key pair, key name"
}

variable "subnet_id" {
  description = "A external subnet id"
}

variable "stack_name" {
  description = "stack name to use as the value for the Terraform tag and in the security group name"
  default     = ""
}

variable "ami_id" {
  description = "ami id to use for the bastion host"
}

variable "external_security_group" {
  description = "Use this security group for external ssh access."
}

variable "cidr" {
  description = "The cidr block to use for internal security groups"
}

variable "private_ip" {
  description = "The private ip address to asssign to the bastion host"
  default = ""
}

/*
module "ami" {
  source        = "github.com/terraform-community-modules/tf_aws_ubuntu_ami/ebs"
  region        = "${var.region}"
  distribution  = "trusty"
  instance_type = "${var.instance_type}"
}
*/

resource "aws_security_group" "can-internal-ssh" {
  name        = "${format("%s-%s-can-internal-ssh", var.stack_name, var.environment)}"
  description = "Membership allows for ssh to other machines"
  vpc_id      = "${var.vpc_id}"

  lifecycle {
    create_before_destroy = true
  }

  tags {
    Name        = "${format("%s %s can internal ssh", var.stack_name, var.environment)}"
    Environment = "${var.environment}"
    Terraform   = "${var.stack_name}"
  }
}

resource "aws_instance" "bastion" {
  ami                    = "${var.ami_id}"
  source_dest_check      = false
  instance_type          = "${var.instance_type}"
  subnet_id              = "${var.subnet_id}"
  key_name               = "${var.key_name}"
  vpc_security_group_ids = ["${var.external_security_group}","${aws_security_group.can-internal-ssh.id}"]
  monitoring             = true
  user_data              = "${file(format("%s/user_data.sh", path.module))}"
  private_ip             = "${var.private_ip}"

  tags {
    Name        = "bastion ${var.environment}"
    Environment = "${var.environment}"
    Terraform   = "${var.stack_name}"
  }
}

resource "aws_eip" "bastion" {
  instance = "${aws_instance.bastion.id}"
  vpc      = true
}

// Bastion external IP address.
output "external_ip" {
  value = "${aws_eip.bastion.public_ip}"
}

output "internal_ip" {
  value = "${aws_eip.bastion.private_ip}"
}

output "instance_id" {
  value = "${coalesce(var.private_ip, aws_instance.bastion.id)}"
}

output "can-internal-ssh" {
  value = "${aws_security_group.can-internal-ssh.id}"
}

{'fraction_non_alphanumeric': 0.1289544235924933, 'fraction_numerical': 0.0021447721179624667, 'mean_word_length': 2.9001568217459486, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5062378', 'n_tokens_mistral': 2477, 'n_tokens_neox': 2417, 'n_words': 653}