基于云服务器 EC2 的云上堡垒机的设计和自动化实现

a. 基于 Amazon Web Services Identity and Access Management (IAM) 角色的最小权限原则，管理员能够通过集中的 IAM 策略管理堡垒机的访问授权。b. 无需管理堡垒机密钥。c. 支持云上私有子网部署，无需部署在公有子网中，且无需打开入站端口。

## 创建Bastion的launch templateresource "aws_launch_template" "bastion_template" {  name = "bastion_template"  block_device_mappings {    device_name = "/dev/xvda"    ebs {      volume_size = 8      encrypted   = true    }  }
  iam_instance_profile {    name = aws_iam_instance_profile.bastion_ec2_profile.id  }
  image_id                             = data.aws_ami.linux_2023_image.id  instance_initiated_shutdown_behavior = "terminate"  instance_type                        = var.bastion_instance_type    monitoring {    enabled = true  }
  network_interfaces {    associate_public_ip_address = false    device_index                = 0    security_groups             = [aws_security_group.bastion.id]    subnet_id                   = element(module.vpc.private_subnets, 0)    delete_on_termination       = true  }
  user_data = base64encode(    templatefile(      "${path.module}/templates/user_data.sh.tftpl",      {        ##传入值到user data中所需要的变量中      }    )  )}
## 创建Bastion的弹性伸缩组resource "aws_autoscaling_group" "bastion_asg" {  launch_template {    id      = aws_launch_template.bastion_template.id    version = "$Latest"  }  availability_zones        = ["${var.region}a","${var.region}b"]  name                      = "bastion_daily"  max_size                  = 1  min_size                  = 1  health_check_grace_period = 300  health_check_type         = "EC2"  force_delete              = true  termination_policies      = ["OldestInstance"]
  tag {    key                 = "Name"    value               = "bastion"    propagate_at_launch = true  }}
## 创建Bastion的弹性伸缩规则-样例中使用定时规则resource "aws_autoscaling_schedule" "bastion_scale_down" {  scheduled_action_name  = "bastion_scale_down"  min_size               = 0  max_size               = 0  desired_capacity       = 0  recurrence             = "0 20 * * *" # 20:00 UTC +8 时间  time_zone              = "Asia/Chongqing"  autoscaling_group_name = aws_autoscaling_group.bastion_asg.name}
resource "aws_autoscaling_schedule" "bastion_scale_up" {  scheduled_action_name  = "bastion_scale_up"  min_size               = 1  max_size               = 1  desired_capacity       = 1  recurrence             = "0 8 * * *" # 8:00 UTC +8 时间  time_zone              = "Asia/Chongqing"  autoscaling_group_name = aws_autoscaling_group.bastion_asg.name}
## 或者基于CPU利用率的弹性伸缩规则（样例）resource "aws_autoscaling_group" "bation_cpu" {  name                 = "bastion-cpu-asg"  launch_configuration = aws_launch_configuration.bastion_template.name  min_size             = 2  max_size             = 4  desired_capacity     = 2    metric_trigger {    metric_name = "CPUUtilization"    namespace   = "AWS/EC2"    statistic   = "Average"    unit        = "Percent"    threshold   = 70  # CPU利用率超过70%时扩容    comparison_operator = "GreaterThanOrEqualToThreshold"    dimensions = {      AutoScalingGroupName = aws_autoscaling_group.bastion_cpu.name    }  }
  scaling_policy {    name = "scale-up-policy"    adjustment_type         = "ChangeInCapacity"    scaling_adjustment      = 1    cooldown               = 300  # 冷却时间300s  }

## 安全加固yum -y update --security
## 仅允许ec2-user访问该目录mkdir /var/log/bastionchown ec2-user:ec2-user /var/log/bastionchmod -R 770 /var/log/bastionsetfacl -Rdm other:0 /var/log/bastion
## Make OpenSSH execute a custom script on loginsecho -e "\\nForceCommand /usr/bin/bastion/shell" >> /etc/ssh/sshd_configecho "AllowTcpForwarding yes" >> /etc/ssh/sshd_configawk '!/X11Forwarding/' /etc/ssh/sshd_config > temp && mv temp /etc/ssh/sshd_configecho "X11Forwarding no" >> /etc/ssh/sshd_config
sed  -i "s/002/022/g" /etc/profileumask 022
## SSH命令记录脚本mkdir /usr/bin/bastioncat > /usr/bin/bastion/shell << 'EOF'
  # The format of log files is /var/log/bastion/YYYY-MM-DD_HH-MM-SS_user  LOG_FILE="`date --date="today" "+%Y-%m-%d_%H-%M-%S"`_`whoami`"  LOG_DIR="/var/log/bastion/"  echo ""  echo "NOTE: This SSH session will be recorded"  echo "AUDIT KEY: $LOG_FILE"  echo ""  SUFFIX=`mktemp -u _XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX`  script -qf --timing=$LOG_DIR$LOG_FILE$SUFFIX.time $LOG_DIR$LOG_FILE$SUFFIX.data --command=/bin/bashEOF
chmod a+x /usr/bin/bastion/shellchown root:ec2-user /usr/bin/scriptchmod g+s /usr/bin/script
##关闭根用户登录systemctl stop sshdecho "PermitRootLogin no" >> /etc/ssh/sshd_configecho "PermitEmptyPasswords no" >> /etc/ssh/sshd_configsystemctl start sshd
## 安装CloudWatch Agent，进行系统日志收集及性能指标收集sudo yum -y install amazon-cloudwatch-agentsudo yum install -y collectdcat > /opt/aws/amazon-cloudwatch-agent/etc/config.json << _EOF_{    "agent": {            "metrics_collection_interval": 60,            "run_as_user": "root"    },    "logs": {            "logs_collected": {                    "files": {                            "collect_list": [                                    {                                            "file_path": "/var/log/messages",                                            "log_group_name": "/aws/ec2/bastion/messages",                                            "log_stream_name": "{instance_id}",                                            "retention_in_days": 30                                    },                                    {                                            "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log",                                            "log_group_name": "/aws/ec2/bastion/amazon-cloudwatch-agent",                                            "log_stream_name": "{instance_id}",                                            "retention_in_days": 30                                    }                            ]                    }            }    },    "metrics": {            "aggregation_dimensions": [                    [                            "InstanceId"                    ]            ],            "append_dimensions": {                    "AutoScalingGroupName": "$${aws:AutoScalingGroupName}",                    "InstanceId": "$${aws:InstanceId}"            },            "metrics_collected": {                    "collectd": {                            "metrics_aggregation_interval": 60                    },                    "disk": {                            "measurement": [                                {                                    "name":"used_percent",                                    "rename":"disk_used_percent"                                }                            ],                            "metrics_collection_interval": 60,                            "resources": [                                    "*"                            ]                    },                    "mem": {                            "measurement": [                                {                                    "name":"used_percent",                                    "rename":"mem_used_percent"                                }                                ],                            "metrics_collection_interval": 60                    },                    "statsd": {                            "metrics_aggregation_interval": 60,                            "metrics_collection_interval": 10,                            "service_address": ":8125"                    }            }    }}_EOF_
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json -ssudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a start

# 创建堡垒机安全组并配置规则resource "aws_security_group" "bastion" {  description = "Ingress should be only from Systems Session Manager"  name        = "bastion-sg"  vpc_id      = module.vpc.vpc_id
  tags = merge(    {      Name = "bastion-sg"    }  )}
resource "aws_security_group_rule" "basion_egress_1" {  security_group_id = aws_security_group.bastion.id
  description = "bastion_to_local_VPC_CIDRs"  type        = "egress"  from_port   = "0"  to_port     = "65535"  protocol    = "TCP"  cidr_blocks = [local.vpc_cidr]}
resource "aws_security_group_rule" "basion_egress_2" {  security_group_id = aws_security_group.bastion.id
  description              = "bastion_egress_to_inteface_endpoints"  type                     = "egress"  from_port                = "443"  to_port                  = "443"  protocol                 = "TCP"  source_security_group_id = aws_security_group.vpc_endpoints.id}
resource "aws_security_group_rule" "bastion_linux_3" {  security_group_id = aws_security_group.bastion.id
  description     = "bastion_linux_egress_to_s3_endpoint"  type            = "egress"  from_port       = "443"  to_port         = "443"  protocol        = "TCP"  prefix_list_ids = [data.aws_vpc_endpoint.s3.prefix_list_id]}

## ssm run shell json{    "schemaVersion": "1.0",    "description" : "Document for SSM log configuration",    "sessionType" : "Standard_Stream",    "inputs": {        "s3BucketName" : "${bucket_name}",        "s3KeyPrefix" : "ssm",        "s3EncryptionEnabled" : true,        "cloudWatchLogGroupName" : "${log_group_name}",        "cloudWatchEncryptionEnabled" : true,        "cloudWatchStreamingEnabled": true,        "kmsKeyId" : "${kms_id}",        "runAsEnabled": true,        "idleSessionTimeout": "20",        "maxSessionDuration":"60",    } }
## IaC code 创建SessionManagerRunShell documentsresource "aws_ssm_document" "ssm_shell" {  name            = "SSM-SessionManagerRunShell"  document_format = "JSON"  document_type   = "Session"  content = templatefile("${path.module}/templates/ssm_runshell.json", {    bucket_name    = join("-", [local.bucket_name, data.aws_caller_identity.current.account_id])    log_group_name = "/aws/sessionmanager"    kms_id         = aws_kms_key.this.arn    }  )}

## 关联托管的IAM Policyresource "aws_iam_role_policy_attachment" "bastion_managed" {  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"  role       = aws_iam_role.bastion_role.name}
resource "aws_iam_role_policy_attachment" "bastion_managed_cloudwatch" {  policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"  role       = aws_iam_role.bastion_role.name}
## 创建IAM 角色及关联的Policy Documentsdata "aws_iam_policy_document" "bastion_assume_policy_document" {  statement {    actions = [      "sts:AssumeRole"    ]    principals {      type        = "Service"      identifiers = ["ec2.amazonaws.com"]    }  }}
resource "aws_iam_role" "bastion_role" {  name               = "bastion_ec2_role"  path               = "/"  assume_role_policy = data.aws_iam_policy_document.bastion_assume_policy_document.json
  tags = merge(    {      Name = "bastion_linux_ec2_role"    },  )}

# Terraform plan 检查要部署的Bastion资源$ terraform plan -var-file=common.tfvars  ## common.tfvars包含堡垒机所需的相关参数
# Terraform apply 执行部署$ terraform apply -var-file=common.tfvars

## 通过CLI获取Bastion的Instance ID$ InstanceID=$(aws ec2 describe-instances --no-cli-pager \    --filters "Name=tag:Name,Values=bastion_linux" \    --query 'Reservations[0].Instances[0].InstanceId' --output text) 
## 启动本地会话$ aws ssm start-session --target $InstanceID

## 通过CLI获取Bastion的Instance ID$ InstanceID=$(aws ec2 describe-instances --no-cli-pager \    --filters "Name=tag:Name,Values=bastion_linux" \    --query 'Reservations[0].Instances[0].InstanceId' --output text) 
## 启动远程主机端口转发，请替换掉命令中的<>为实际的远程端口、本地端口以及远程主机IP或者DNS$ aws ssm start-session --target $InstanceID \      --document-name AWS-StartPortForwardingSessionToRemoteHost \      --parameters '{"portNumber":["<Remote_Host_Port_Number>"],"localPortNumber":["<LocalPortNumber>"],"host":["<Remote_Host_DNS/IP>"]}'

## Step 1: 通过 CLI 获取 Bastion 的 Instance ID$ InstanceID=$(aws ec2 describe-instances --no-cli-pager \    --filters "Name=tag:Name,Values=bastion_linux" \    --query 'Reservations[0].Instances[0].InstanceId' --output text) ## Step 2: 生成临时 ssh key$ echo -ne "Generating SSH key pair................\r"$ echo -e 'y\n' | ssh-keygen -t rsa -f temp-key -N '' > /dev/null 2>&1
## Step 3: 发送生成 SSH public key 到堡垒机中，根据实际情况替换掉命令行中的变量$ echo -ne "Pushing public key to instance.........\r"$ aws ec2-instance-connect send-ssh-public-key --region $AWS_DEFAULT_REGION \    --instance-id $instanceId --availability-zone <az> \    --instance-os-user <ssm_user> \    --ssh-public-key file://temp-key.pub > /dev/null 2>&1
## Step 4: 修改 ~/.ssh/config 配置（仅需要一次配置）Host test-ssh-bastion     IdentityFile ~/test/temp-key     StrictHostKeyChecking no     UserKnownHostsFile /dev/null     LogLevel QUIET     User ec2-user     ProxyCommand sh -c "aws ssm start-session --target $(aws ec2 describe-instances --no-cli-pager \        --filters 'Name=tag:Name,Values=bastion_linux' \        --query 'Reservations[0].Instances[0].InstanceId' --output text) \     --document-name AWS-StartSSHSession --parameters 'portNumber=%p' --region us-east-1"
## Step 5: 修改完成后，通过 ssh 就可以连接到堡垒机中,如下图所示$ ssh test-ssh-bastion

ssh -f -N -p 2200 -i temp -o "IdentitiesOnly=yes" -D 1080 ec2-user@localhost