Browse the Repo

file-type-icon.circleci
file-type-icon.github
file-type-icon.patcher
file-type-icon_ci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconauto-update
file-type-iconaws-config-multi-region
file-type-iconaws-config-rules
file-type-iconaws-config
file-type-iconaws-organizations
file-type-iconcloudtrail-custom-key
file-type-iconcloudtrail
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconebs-encryption-multi-region
file-type-iconfail2ban
file-type-icongithub-actions-iam-role
file-type-iconguardduty
file-type-iconiam-access-analyzer-multi-region
file-type-iconiam-groups
file-type-iconiam-user-password-policy
file-type-iconiam-users
file-type-iconip-lockdown
file-type-iconkms-grant-multi-region
file-type-iconkms-master-key-multi-region
file-type-iconkms-master-key
file-type-iconntp
file-type-iconos-hardening
file-type-iconprivate-s3-bucket-with-replication
file-type-iconprivate-s3-bucket
file-type-iconsaml-iam-roles
file-type-iconsecrets-manager-resource-policies
file-type-iconssh-grunt
file-type-iconiam
file-type-iconpacker
file-type-iconREADME.md
file-type-iconbuild-binary.sh
file-type-iconssh-grunt-iam.json
file-type-iconssm-healthchecks-iam-permissions
file-type-iconmodules
file-type-icontest
file-type-icon.editorconfig
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.adoc
file-type-iconterraform-cloud-enterprise-private-module-...

Browse the Repo

file-type-icon.circleci
file-type-icon.github
file-type-icon.patcher
file-type-icon_ci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconauto-update
file-type-iconaws-config-multi-region
file-type-iconaws-config-rules
file-type-iconaws-config
file-type-iconaws-organizations
file-type-iconcloudtrail-custom-key
file-type-iconcloudtrail
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconebs-encryption-multi-region
file-type-iconfail2ban
file-type-icongithub-actions-iam-role
file-type-iconguardduty
file-type-iconiam-access-analyzer-multi-region
file-type-iconiam-groups
file-type-iconiam-user-password-policy
file-type-iconiam-users
file-type-iconip-lockdown
file-type-iconkms-grant-multi-region
file-type-iconkms-master-key-multi-region
file-type-iconkms-master-key
file-type-iconntp
file-type-iconos-hardening
file-type-iconprivate-s3-bucket-with-replication
file-type-iconprivate-s3-bucket
file-type-iconsaml-iam-roles
file-type-iconsecrets-manager-resource-policies
file-type-iconssh-grunt
file-type-iconiam
file-type-iconpacker
file-type-iconREADME.md
file-type-iconbuild-binary.sh
file-type-iconssh-grunt-iam.json
file-type-iconssm-healthchecks-iam-permissions
file-type-iconmodules
file-type-icontest
file-type-icon.editorconfig
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.adoc
file-type-iconterraform-cloud-enterprise-private-module-...
ssh-grunt

ssh-grunt

Manage SSH access to EC2 Instances using groups in AWS IAM or your Identity Provider (e.g., ADFS, Google, Okta, etc).

Code Preview

Preview the Code

mobile file icon

README.md

down

Example ssh-grunt Packer template

This folder contains a Packer template that shows how to create an Amazon Machine Image (AMI) with ssh-grunt installed. The AMIs is configured to use ssh-grunt with IAM.

Note: To make it possible to run automated tests against this example, we build the ssh-grunt binary locally and use the Packer file provisioner to copy it into our AMI. This is NOT how you would do it in a real-world use case. Instead, we recommend using the Gruntwork installer:

{
  "type": "shell",
  "inline": "curl -Ls https://raw.githubusercontent.com/gruntwork-io/gruntwork-installer/main/bootstrap-gruntwork-installer.sh | bash /dev/stdin --version {{user `gruntwork_installer_version`}}"
},
{
  "type": "shell",
  "inline": [
    "gruntwork-install --binary-name ssh-grunt --tag v0.14.0 --repo https://github.com/gruntwork-io/terraform-aws-security",
    "sudo /usr/local/bin/ssh-grunt iam install --iam-group MyIamGroup --iam-group-sudo MyIamSudoGroup"
  ],
  "environment_vars": [
    "GITHUB_OAUTH_TOKEN={{user `github_auth_token`}}"
  ]
}

Building the IAM example AMI

  1. Create two IAM groups: one with IAM users that need SSH access with sudo privileges and one with IAM users that need SSH access without sudo privileges.

  2. Build the ssh-grunt binary: build-binary.sh

  3. Build the Packer template under ssh-grunt-iam.json:

    • Export GITHUB_OAUTH_TOKEN. This is your Github personal access token and you can read more here how to create it.
    • Pass the name of the groups you created in the previous step using the iam_group_sudo and iam_group variables.
    • Pass the desired branch name for the terraform-aws-security repository that is necessary using module_security_branch variable. The default value is main.
    • You might need to pass the ARN of the IAM role that you're about to assume from the account where the IAM User Groups are defined already. To provide extra arguments use the extra_install_args variable. For example:

    --role-arn arn:aws:iam::031888425624:role/allow-ssh-grunt-access-from-other-accounts

    • Run the following command:

    packer build -var module_security_branch=main -var iam_group_sudo=ssh-sudo-group -var iam_group=ssh-group ssh-grunt-iam.json

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?