[#327] Use AWS Session Manager to Securely connect to an EC2 instance

[tung-nimblehq]

• Close Use AWS Session Manager to Securely connect to an EC2 instance. #327

What happened 👀

• Add iam_role module.
• Update bastion module to set iam_instance_profile to allow it to connect with SSM.
• Remove bastion_ingress_ssh_nimble ingress rule.
• Add bastion_egress_ssm egress rule.
• Remove variable bastion_image_id to use amazon_linux_2023 that will ensure the SSM agent was already set up on the image instance.
• Create SSMInstanceRole to attach AmazonSSMManagedInstanceCore to bastion instance allow to connect with SSM

Insight 📝

• Create Iam_role module to allow us to reuse for case needs to create role or profile(ec2), that's easier to maintain and more readable than injecting inside bastion main.tf content.
• Before, we had bastion_image_id, which was inconvenient for developer experience because we had to go to the AWS console or use the CLI to list bastion image IDs, which took time and wasn't very necessary for a bastion instance. Instead, we can force the bastion to use the optimized and recommended image instance from AWS, amazon_linux_2023. It also sets up the SSM agent for us.
• Still keep logic creating key-pair, but its default does not create.

variable "key_name" {
  description = "The name of the key pair to use for the instance"
  type        = string
  default     = "" // Set empty to disable key pair
}

• Some benefits of SSM login instead of a key pair
  • Eliminating SSH key pair management
  • Removing the need to expose port 22
  • Enabling centralized, IAM-based access control
  • Providing full auditing and session logging
  • Aligning with AWS best practices for EC2 access

Proof Of Work 📹

Able to connect bastion instance without keypair, without an open ssh port, and without set specific ip address for connection

Screen.Recording.2026-01-24.at.21.28.34.mov

[DustinDust]

Approved with optional minor comments 💯

[toby-thanathip]

I've scanned through it, but I'm not certified enough to approve this. 🙇

→ Totally new to this template and Terraform; But, good to get the idea. 👍

[toby-thanathip]

Since we're replacing SSH with SSM, can we remove this? 🙏

[tung-nimblehq]

Hmm removed in 90b3e99