59 lines
1.6 KiB
Terraform
59 lines
1.6 KiB
Terraform
|
#
|
||
|
|
# This machine exists for the end-user to ssh into and access
|
||
|
|
# internal-only ingresses.
|
||
|
|
#
|
||
|
|
|
||
|
|
output "user_machine_ssh_command" {
|
||
|
|
description = "Command to launch an ssh shell on the user machine."
|
||
|
|
value = "gcloud compute ssh --zone '${var.zone}' '${google_compute_instance.user_machine.name}' --project '${google_project.project.project_id}'"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "google_service_account" "user_machine" {
|
||
|
|
project = google_project.project.project_id
|
||
|
|
account_id = "user-machine"
|
||
|
|
display_name = "Custom SA for User Machine VM Instance"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "google_compute_instance" "user_machine" {
|
||
|
|
project = google_project.project.project_id
|
||
|
|
name = "user-machine"
|
||
|
|
machine_type = "g1-small"
|
||
|
|
zone = var.zone
|
||
|
|
tags = ["allow-iap-ssh"]
|
||
|
|
|
||
|
|
boot_disk {
|
||
|
|
initialize_params {
|
||
|
|
image = "debian-cloud/debian-12"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
network_interface {
|
||
|
|
network = google_compute_network.default.id
|
||
|
|
subnetwork = google_compute_subnetwork.default.id
|
||
|
|
}
|
||
|
|
|
||
|
|
service_account {
|
||
|
|
email = google_service_account.user_machine.email
|
||
|
|
scopes = ["cloud-platform"]
|
||
|
|
}
|
||
|
|
|
||
|
|
metadata = var.ssh_key != null ? {
|
||
|
|
ssh-keys = var.ssh_key
|
||
|
|
} : {}
|
||
|
|
|
||
|
|
depends_on = [google_project_service.service["compute"], google_project_service.service["logging"]]
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "google_compute_firewall" "allow_iap_ssh" {
|
||
|
|
project = google_project.project.project_id
|
||
|
|
name = "allow-iap-ssh"
|
||
|
|
network = google_compute_network.default.id
|
||
|
|
direction = "INGRESS"
|
||
|
|
allow {
|
||
|
|
protocol = "tcp"
|
||
|
|
ports = ["22"]
|
||
|
|
}
|
||
|
|
source_ranges = ["35.235.240.0/20"]
|
||
|
|
target_tags = ["allow-iap-ssh"]
|
||
|
|
}
|