Package: basti-cdk
Basti CDKBasti CDKis a construct library that allows you to create cost-efficientbastion instancesand easily connect to your infrastructure withBasti CLI.💵No idle costs.🔑No SSH keys.🔒Fully IAM-driven.Table of contentsWhy Basti?How it worksInstallationNPMPyPIAPI referenceExamplesBasic usageSet up Basti instanceAllow connection to targetConnect to targetAdvanced usageImporting existing Basti instanceGranting access to use Basti instanceLicenseWhy Basti?WithBasti, you can securely connect to your RDS/Aurora/Elasticache/EC2 instances in private VPC subnets from a local machine or CI/CD pipeline almost for free!How it works🏰 Using Basti CDK, you set up a bastion instance in the connection target's VPC.🧑‍💻 You useBasti CLIto conveniently connect to your target through the bastion instance.💵 Basti takes care of keeping the bastion instance stopped when it's not used to make the solution cost as low as≈ 0.01 USDper hour of connection plus≈ 0.80 USDper month of maintaining the instance in a stopped state.🔒 Security completely relies on AWS Session Manager and IAM policies. The bastion instance is not accessible from the Internet and no SSH keys are used.InstallationThe construct is available in multiple languages thanks toJSII.NPMnpminstallbasti-cdkPyPIpipinstallbasti-cdkAPI referenceSee the full API referenceon Construct Hub.ExamplesSeethe test CDK appsfor working examples of each feature the library provides.Basic usageBasti constructs can be imported from thebasti-cdkpackage.import{BastiAccessSecurityGroup,BastiInstance}from'basti-cdk';💡 RDS instance is used as an example target. You can use Basti to connect to any other AWS resource that supports security groups.Set up Basti instanceUseBastiInstanceconstruct to create Basti EC2 instance.constbastiInstance=newBastiInstance(stack,'BastiInstance',{vpc,//Optional.Randomlygeneratedifomitted.//UsedtonametheEC2instanceandotherresources.//Theresultingnamewillbe"basti-instance-my-bastion"bastiId:'my-bastion'});Allow connection to targetUseBastiAccessSecurityGroupconstruct to create a security group for your target. This security group will allow the Basti instance to connect to the target.//CreateasecuritygroupforyourtargetconstbastiAccessSecurityGroup=newBastiAccessSecurityGroup(stack,'BastiAccessSecurityGroup',{vpc,//Optional.Randomlygeneratedifomitted.//Usedtonamethesecuritygroupandotherresources.//Theresultingnamewillbe"basti-access-my-target"bastiId:'my-target'});//CreatethetargetconstrdsInstance=newaws_rds.DatabaseInstance(stack,'RdsInstance',{//Unrelatedpropertiesareomittedforbrevityvpc,port:5432,securityGroups:[bastiAccessSecurityGroup]});//AllowtheBastiinstancetoconnecttothetargetonthespecifiedportbastiAccessSecurityGroup.allowBastiInstanceConnection(bastiInstance,aws_ec2.Port.tcp(rdsInstance.instanceEndpoint.port));Connect to targetWhen the stack is deployed, you can useBasti CLIto connect to your target.basticonnectAdvanced usageImporting existing Basti instanceWhen sharing a Basti instance across stacks, you can just pass it as a property to the other stack. In case you need to import a Basti instance created in a separate CDK app or not managed by CDK at all, you can use theBastiInstance.fromBastiIdmethod. The method returns anIBastiInstanceobject which is sufficient for granting access to a connection target.//Mostlikely,theVPCwascreatedseparatelyaswellconstvpc=aws_ec2.Vpc.fromLookup(stack,'Vpc',{vpcName:'existing-vpc-id',});constbastiInstance=BastiInstance.fromBastiId(this,'BastiInstance',//TheBastiIDoftheBastiinstanceyouwanttoimport'existing-basti-id',vpc);//bastiInstancecannowbeusedtoallowaccesstoaconnectiontargetbastiAccessSecurityGroup.allowBastiInstanceConnection(bastiInstance,aws_ec2.Port.tcp(1717));Granting access to use Basti instanceYou can grant the ability to connect to a Basti instance to other resources (users, roles, etc.) using thegrantBastiCliConnectmethod of an existing Basti instance.constbastiInstance=newBastiInstance(/*...*/);constgrantee=newaws_iam.Role(/*...*/);bastiInstance.grantBastiCliConnect(grantee);LicenseUsage is provided under the MIT License. SeeLICENSEfor the full details.