基于 Amazon EC2 和 Amazon Systems Manager Session Manager 的堡垒机的设计和自动化实现

## 创建Bastion的launch template
resource "aws_launch_template" "bastion_template" {
  name = "bastion_template"
  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_size = 8
      encrypted   = true
    }
  }

  iam_instance_profile {
    name = aws_iam_instance_profile.bastion_ec2_profile.id
  }

  image_id                             = data.aws_ami.linux_2023_image.id
  instance_initiated_shutdown_behavior = "terminate"
  instance_type                        = var.bastion_instance_type
  
  monitoring {
    enabled = true
  }

  network_interfaces {
    associate_public_ip_address = false
    device_index                = 0
    security_groups             = [aws_security_group.bastion.id]
    subnet_id                   = element(module.vpc.private_subnets, 0)
    delete_on_termination       = true
  }

  user_data = base64encode(
    templatefile(
      "${path.module}/templates/user_data.sh.tftpl",
      {
        ##传入值到user data中所需要的变量中
      }
    )
  )
}

## 创建Bastion的弹性伸缩组
resource "aws_autoscaling_group" "bastion_asg" {
  launch_template {
    id      = aws_launch_template.bastion_template.id
    version = "$Latest"
  }
  availability_zones        = ["${var.region}a","${var.region}b"]
  name                      = "bastion_daily"
  max_size                  = 1
  min_size                  = 1
  health_check_grace_period = 300
  health_check_type         = "EC2"
  force_delete              = true
  termination_policies      = ["OldestInstance"]

  tag {
    key                 = "Name"
    value               = "bastion"
    propagate_at_launch = true
  }
}

## 创建Bastion的弹性伸缩规则-样例中使用定时规则
resource "aws_autoscaling_schedule" "bastion_scale_down" {
  scheduled_action_name  = "bastion_scale_down"
  min_size               = 0
  max_size               = 0
  desired_capacity       = 0
  recurrence             = "0 20 * * *" # 20:00 UTC +8 时间
  time_zone              = "Asia/Chongqing"
  autoscaling_group_name = aws_autoscaling_group.bastion_asg.name
}

resource "aws_autoscaling_schedule" "bastion_scale_up" {
  scheduled_action_name  = "bastion_scale_up"
  min_size               = 1
  max_size               = 1
  desired_capacity       = 1
  recurrence             = "0 8 * * *" # 8:00 UTC +8 时间
  time_zone              = "Asia/Chongqing"
  autoscaling_group_name = aws_autoscaling_group.bastion_asg.name
}

## 或者基于CPU利用率的弹性伸缩规则（样例）
resource "aws_autoscaling_group" "bation_cpu" {
  name                 = "bastion-cpu-asg"
  launch_configuration = aws_launch_configuration.bastion_template.name
  min_size             = 2
  max_size             = 4
  desired_capacity     = 2
  
  metric_trigger {
    metric_name = "CPUUtilization"
    namespace   = "AWS/EC2"
    statistic   = "Average"
    unit        = "Percent"
    threshold   = 70  # CPU利用率超过70%时扩容
    comparison_operator = "GreaterThanOrEqualToThreshold"
    dimensions = {
      AutoScalingGroupName = aws_autoscaling_group.bastion_cpu.name
    }
  }

  scaling_policy {
    name = "scale-up-policy"
    adjustment_type         = "ChangeInCapacity"
    scaling_adjustment      = 1
    cooldown               = 300  # 冷却时间300s
  }

## 安全加固
yum -y update --security

## 仅允许ec2-user访问该目录
mkdir /var/log/bastion
chown ec2-user:ec2-user /var/log/bastion
chmod -R 770 /var/log/bastion
setfacl -Rdm other:0 /var/log/bastion

## Make OpenSSH execute a custom script on logins
echo -e "\\nForceCommand /usr/bin/bastion/shell" >> /etc/ssh/sshd_config
echo "AllowTcpForwarding yes" >> /etc/ssh/sshd_config
awk '!/X11Forwarding/' /etc/ssh/sshd_config > temp && mv temp /etc/ssh/sshd_config
echo "X11Forwarding no" >> /etc/ssh/sshd_config

sed  -i "s/002/022/g" /etc/profile
umask 022

## SSH命令记录脚本
mkdir /usr/bin/bastion
cat > /usr/bin/bastion/shell << 'EOF'

  # The format of log files is /var/log/bastion/YYYY-MM-DD_HH-MM-SS_user
  LOG_FILE="`date --date="today" "+%Y-%m-%d_%H-%M-%S"`_`whoami`"
  LOG_DIR="/var/log/bastion/"
  echo ""
  echo "NOTE: This SSH session will be recorded"
  echo "AUDIT KEY: $LOG_FILE"
  echo ""
  SUFFIX=`mktemp -u _XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX`
  script -qf --timing=$LOG_DIR$LOG_FILE$SUFFIX.time $LOG_DIR$LOG_FILE$SUFFIX.data --command=/bin/bash
EOF

chmod a+x /usr/bin/bastion/shell
chown root:ec2-user /usr/bin/script
chmod g+s /usr/bin/script

##关闭根用户登录
systemctl stop sshd
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config
systemctl start sshd

## 安装CloudWatch Agent，进行系统日志收集及性能指标收集
sudo yum -y install amazon-cloudwatch-agent
sudo yum install -y collectd
cat > /opt/aws/amazon-cloudwatch-agent/etc/config.json << _EOF_
{
    "agent": {
            "metrics_collection_interval": 60,
            "run_as_user": "root"
    },
    "logs": {
            "logs_collected": {
                    "files": {
                            "collect_list": [
                                    {
                                            "file_path": "/var/log/messages",
                                            "log_group_name": "/aws/ec2/bastion/messages",
                                            "log_stream_name": "{instance_id}",
                                            "retention_in_days": 30
                                    },
                                    {
                                            "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log",
                                            "log_group_name": "/aws/ec2/bastion/amazon-cloudwatch-agent",
                                            "log_stream_name": "{instance_id}",
                                            "retention_in_days": 30
                                    }
                            ]
                    }
            }
    },
    "metrics": {
            "aggregation_dimensions": [
                    [
                            "InstanceId"
                    ]
            ],
            "append_dimensions": {
                    "AutoScalingGroupName": "$${aws:AutoScalingGroupName}",
                    "InstanceId": "$${aws:InstanceId}"
            },
            "metrics_collected": {
                    "collectd": {
                            "metrics_aggregation_interval": 60
                    },
                    "disk": {
                            "measurement": [
                                {
                                    "name":"used_percent",
                                    "rename":"disk_used_percent"
                                }
                            ],
                            "metrics_collection_interval": 60,
                            "resources": [
                                    "*"
                            ]
                    },
                    "mem": {
                            "measurement": [
                                {
                                    "name":"used_percent",
                                    "rename":"mem_used_percent"
                                }    
                            ],
                            "metrics_collection_interval": 60
                    },
                    "statsd": {
                            "metrics_aggregation_interval": 60,
                            "metrics_collection_interval": 10,
                            "service_address": ":8125"
                    }
            }
    }
}
_EOF_

sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json -s
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a start

# 创建堡垒机安全组并配置规则
resource "aws_security_group" "bastion" {
  description = "Ingress should be only from Systems Session Manager"
  name        = "bastion-sg"
  vpc_id      = module.vpc.vpc_id

  tags = merge(
    {
      Name = "bastion-sg"
    }
  )
}

resource "aws_security_group_rule" "basion_egress_1" {
  security_group_id = aws_security_group.bastion.id

  description = "bastion_to_local_VPC_CIDRs"
  type        = "egress"
  from_port   = "0"
  to_port     = "65535"
  protocol    = "TCP"
  cidr_blocks = [local.vpc_cidr]
}

resource "aws_security_group_rule" "basion_egress_2" {
  security_group_id = aws_security_group.bastion.id

  description              = "bastion_egress_to_inteface_endpoints"
  type                     = "egress"
  from_port                = "443"
  to_port                  = "443"
  protocol                 = "TCP"
  source_security_group_id = aws_security_group.vpc_endpoints.id
}

resource "aws_security_group_rule" "bastion_linux_3" {
  security_group_id = aws_security_group.bastion.id

  description     = "bastion_linux_egress_to_s3_endpoint"
  type            = "egress"
  from_port       = "443"
  to_port         = "443"
  protocol        = "TCP"
  prefix_list_ids = [data.aws_vpc_endpoint.s3.prefix_list_id]
}

## ssm run shell json
{
    "schemaVersion": "1.0",
    "description" : "Document for SSM log configuration",
    "sessionType" : "Standard_Stream",
    "inputs": {
        "s3BucketName" : "${bucket_name}",
        "s3KeyPrefix" : "ssm",
        "s3EncryptionEnabled" : true,
        "cloudWatchLogGroupName" : "${log_group_name}",
        "cloudWatchEncryptionEnabled" : true,
        "cloudWatchStreamingEnabled": true,
        "kmsKeyId" : "${kms_id}",
        "runAsEnabled": true,
        "idleSessionTimeout": "20",
        "maxSessionDuration":"60",
    } 
}

## IaC code 创建SessionManagerRunShell documents
resource "aws_ssm_document" "ssm_shell" {
  name            = "SSM-SessionManagerRunShell"
  document_format = "JSON"
  document_type   = "Session"
  content = templatefile("${path.module}/templates/ssm_runshell.json", {
    bucket_name    = join("-", [local.bucket_name, data.aws_caller_identity.current.account_id])
    log_group_name = "/aws/sessionmanager"
    kms_id         = aws_kms_key.this.arn
    }
  )
}

## 关联托管的IAM Policy
resource "aws_iam_role_policy_attachment" "bastion_managed" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  role       = aws_iam_role.bastion_role.name
}

resource "aws_iam_role_policy_attachment" "bastion_managed_cloudwatch" {
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
  role       = aws_iam_role.bastion_role.name
}

## 创建IAM 角色及关联的Policy Documents
data "aws_iam_policy_document" "bastion_assume_policy_document" {
  statement {
    actions = [
      "sts:AssumeRole"
    ]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "bastion_role" {
  name               = "bastion_ec2_role"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.bastion_assume_policy_document.json

  tags = merge(
    {
      Name = "bastion_linux_ec2_role"
    },
  )
}

# Terraform plan 检查要部署的Bastion资源
$ terraform plan -var-file=common.tfvars  ## common.tfvars包含堡垒机所需的相关参数

# Terraform apply 执行部署
$ terraform apply -var-file=common.tfvars

## 通过CLI获取Bastion的Instance ID
$ InstanceID=$(aws ec2 describe-instances --no-cli-pager \
    --filters "Name=tag:Name,Values=bastion_linux" \
    --query 'Reservations[0].Instances[0].InstanceId' --output text) 

## 启动本地会话
$ aws ssm start-session --target $InstanceID

## 通过CLI获取Bastion的Instance ID
$ InstanceID=$(aws ec2 describe-instances --no-cli-pager \
    --filters "Name=tag:Name,Values=bastion_linux" \
    --query 'Reservations[0].Instances[0].InstanceId' --output text) 

## 启动远程主机端口转发，请替换掉命令中的<>为实际的远程端口、本地端口以及远程主机IP或者DNS
$ aws ssm start-session --target $InstanceID \
      --document-name AWS-StartPortForwardingSessionToRemoteHost \
      --parameters '{"portNumber":["<Remote_Host_Port_Number>"],"localPortNumber":["<LocalPortNumber>"],"host":["<Remote_Host_DNS/IP>"]}'

## Step 1: 通过 CLI 获取 Bastion 的 Instance ID
$ InstanceID=$(aws ec2 describe-instances --no-cli-pager \
    --filters "Name=tag:Name,Values=bastion_linux" \
    --query 'Reservations[0].Instances[0].InstanceId' --output text)
 
## Step 2: 生成临时 ssh key
$ echo -ne "Generating SSH key pair................\r"
$ echo -e 'y\n' | ssh-keygen -t rsa -f temp-key -N '' > /dev/null 2>&1

## Step 3: 发送生成 SSH public key 到堡垒机中，根据实际情况替换掉命令行中的变量
$ echo -ne "Pushing public key to instance.........\r"
$ aws ec2-instance-connect send-ssh-public-key --region $AWS_DEFAULT_REGION \
    --instance-id $instanceId --availability-zone <az> \
    --instance-os-user <ssm_user> \
    --ssh-public-key file://temp-key.pub > /dev/null 2>&1

## Step 4: 修改 ~/.ssh/config 配置（仅需要一次配置）
Host test-ssh-bastion
     IdentityFile ~/test/temp-key
     StrictHostKeyChecking no
     UserKnownHostsFile /dev/null
     LogLevel QUIET
     User ec2-user
     ProxyCommand sh -c "aws ssm start-session --target $(aws ec2 describe-instances --no-cli-pager \
        --filters 'Name=tag:Name,Values=bastion_linux' \
        --query 'Reservations[0].Instances[0].InstanceId' --output text) \
     --document-name AWS-StartSSHSession --parameters 'portNumber=%p' --region us-east-1"

## Step 5: 修改完成后，通过 ssh 就可以连接到堡垒机中,如下图所示
$ ssh test-ssh-bastion

ssh -f -N -p 2200 -i temp -o "IdentitiesOnly=yes" -D 1080 ec2-user@localhost