search

basti-app / basti

✨ Securely connect to RDS, Elasticache, and other AWS resources in VPCs with no idle cost
https://www.basti.app
MIT License
351 stars 18 forks source link

assignPublicIp to be false #103

Closed maartenvanderhoef closed 2 months ago

maartenvanderhoef commented 4 months ago

https://github.com/basti-app/basti/blob/fcc1dd09ed54489303bcb7caf1bb3552914f61f7/packages/basti/src/bastion/create-bastion.ts#L204

assignPublicIp: true

I think this is wrong by design and should at least be configurable. A public ip is really not required with ssm. The only thing the instance needs to do is to connect to the amazonaws.com domains via VPC Endpoints, or a through a connection with the internet and this can also work well via a NAT GW or a Transit GW.

BohdanPetryshyn commented 4 months ago

Hi @maartenvanderhoef and thank you for pointing this out! The reason I enabled public IPs by default is that setting up Basti instance in a public subnet is expected to be the most common use case for the tool. The public IP is indeed not needed in the situations you described. The easiest solution would be to make it configurable (and enabled by default) but I'd also try to come up with a more automated solution that would determine if the option needs to be enabled 🤔

I'm currently having a long summer vacation, so I will only be able to focus on the problem in a couple of weeks. Meanwhile, any ideas are very much appreciated!

BohdanPetryshyn commented 2 months ago

Hi @maartenvanderhoef, @m-keil, @jrobbins-LiveData, @georg-ikegps, @davidski (all who reacted to this issue) 👋

With basti@1.7.0 (and basti-cdk@1.1.0), you can now disable the automatic public IP assignment with the --bastion-assign-public-ip false CLI option 🚀

Please, see docs for more details: link