DEV Community: Tomasz Szuster

GitLab runner on MacBook with docker-compose

Tomasz Szuster — Tue, 30 Jan 2024 23:08:03 +0000

It turned out that running a self-hosted Gitlab runner on a MacBook with docker desktop and docker-compose was not so common approach.

Below are code snippets that enable that solution

docker-compose.yaml

version: '3'
services:

 gitlab-runner:
  image: gitlab/gitlab-runner:alpine
  restart: always
  container_name: gitlab-runner
  hostname: gitlab-runner
  volumes:
   - /Users/gitlab-runner:/etc/gitlab-runner
   - /var/run/docker.sock:/var/run/docker.sock
  environment:
    - DOCKER_HOST=unix:///var/run/docker.sock
  networks:
      - gitlab-network

networks:
  gitlab-network:
    name: gitlab-network

runner configuration config.yaml

concurrent = 2
check_interval = 0
shutdown_timeout = 0

[session_server]
  session_timeout = 1800

[[runners]]
  name = "docker-stable"
  url = "https://gitlab.com"
  id = 112233
  token = "112233"
  token_obtained_at = 1111-01-24T21:09:11Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "docker"
  [runners.cache]
    MaxUploadedArchiveSize = 0
  [runners.docker]
    tls_verify = false
    image = "docker:stable"
    privileged = false
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/var/run/docker.sock:/var/run/docker.sock", "/cache"]
    network_mode = "host"
    shm_size = 0
    network_mtu = 0

AWS CDK ARM64 CodeBuild is broken

Tomasz Szuster — Wed, 05 Apr 2023 09:36:44 +0000

That's so sad that AWS is not doing a good job with undifferentiated heavy lifting.
A lot of noise but the reality as usual shows what is true.

Below is a simple example of CDK Pipelines which should work


pipelines.CodePipeline(
    self,
    "pipeline",
    self_mutation_code_build_defaults=pipelines.CodeBuildOptions(
        partial_build_spec=codebuild.BuildSpec.from_object(
            {
                "phases": {
                    "install": {
                        "commands": [
                            "npm cache clean -f",
                            "n 16",
                            "node -v",
                        ]
                    }
                }
            }
        )
    ),
    code_build_defaults=pipelines.CodeBuildOptions(
        role_policy=[
            iam.PolicyStatement(actions=["*"], resources=["*"]),
            iam.PolicyStatement(actions=["sts:AssumeRole"], resources=["*"]),
        ],
        build_environment=codebuild.BuildEnvironment(
            compute_type=codebuild.ComputeType.LARGE,
            build_image=codebuild.LinuxBuildImage.AMAZON_LINUX_2_ARM_2,
        ),
        partial_build_spec=codebuild.BuildSpec.from_object(
            {
                "phases": {
                    "install": {
                        "commands": [
                            "npm cache clean -f",
                            "n 16",
                            "node -v",
                        ]
                    }
                }
            }
        ),
    ),
    synth=pipelines.ShellStep(
        "synth",
        input=pipelines.CodePipelineSource.connection(
            repo_string=pipeline_vars.github_git_repo,
            branch="main",
            connection_arn=pipeline_vars.github_connection_arn,
        ),
        install_commands=[
            "npm cache clean -f",
            "n 16",
            "node -v",
            "pip install -r requirements.txt",
            "npm install -g aws-cdk",
        ],
        commands=[
            "cdk synth",
        ],
    ),
    pipeline_name=pipeline_vars.project,
    self_mutation=True,
)

What we need to remember is that AWS doesn't provide updated build image that contain supported node version, ideally 16 or 18, but they stick with node 12!

The pipeline above is enforcing node 16 installation for pipeline synth and self-mutation.

AWS WAF with CDK simple way, L2?

Tomasz Szuster — Tue, 04 Oct 2022 20:42:16 +0000

Below content is for those of you that want to use more L2 CDK constructs when creating IaC for AWS WAF.

Short intro, the current state of WAF L2's for CDK is that they mostly don't exist, thus having easy to use methods is far-far away.

Although closer than you may think.

Let's share what I've created sometime ago.

Python WAF class to manage more or less sensible values for starting your CDK project

class WAFv2(Construct):
    """Implement a v2 WAF where logs are sent to the AWS CloudWatch logs."""

    # pylint: disable=W0235
    def __init__(self, scope: Construct, construct_id: str) -> None:
        super().__init__(scope, construct_id)

    @staticmethod
    def __aws_account_takeover_prevention(aws_account_takeover_prevention):
        return wafv2.CfnWebACL.RuleProperty(
            name="AWS-AWSManagedRulesATPRuleSet",
            priority=6,
            override_action=wafv2.CfnWebACL.OverrideActionProperty(none={}),
            statement=wafv2.CfnWebACL.StatementProperty(
                managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
                    name="AWSManagedRulesATPRuleSet",
                    vendor_name="AWS",
                    managed_rule_group_configs=[
                        wafv2.CfnWebACL.ManagedRuleGroupConfigProperty(
                            login_path=aws_account_takeover_prevention["login_path"],  # type: ignore
                        ),
                        wafv2.CfnWebACL.ManagedRuleGroupConfigProperty(
                            password_field=wafv2.CfnWebACL.FieldIdentifierProperty(
                                identifier=aws_account_takeover_prevention["password_field"]  # type: ignore
                            ),
                        ),
                        wafv2.CfnWebACL.ManagedRuleGroupConfigProperty(
                            payload_type="FORM_ENCODED",
                        ),
                        wafv2.CfnWebACL.ManagedRuleGroupConfigProperty(
                            username_field=wafv2.CfnWebACL.FieldIdentifierProperty(
                                identifier=aws_account_takeover_prevention["username_field"]  # type: ignore
                            ),
                        ),
                    ],
                )
            ),
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True,
                metric_name="AWS-AWSManagedRulesATPRuleSet",
                sampled_requests_enabled=True,
            ),
        )

    @staticmethod
    def __aws_sqli_rule():
        return wafv2.CfnWebACL.RuleProperty(
            name="AWS-AWSManagedRulesSQLiRuleSet",
            priority=5,
            override_action=wafv2.CfnWebACL.OverrideActionProperty(none={}),
            statement=wafv2.CfnWebACL.StatementProperty(
                managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
                    name="AWSManagedRulesSQLiRuleSet",
                    vendor_name="AWS",
                )
            ),
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True,
                metric_name="AWS-AWSManagedRulesSQLiRuleSet",
                sampled_requests_enabled=True,
            ),
        )

    @staticmethod
    def __aws_bad_inputs_rule():
        return wafv2.CfnWebACL.RuleProperty(
            name="AWS-AWSManagedRulesKnownBadInputsRuleSet",
            priority=4,
            override_action=wafv2.CfnWebACL.OverrideActionProperty(none={}),
            statement=wafv2.CfnWebACL.StatementProperty(
                managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
                    name="AWSManagedRulesKnownBadInputsRuleSet",
                    vendor_name="AWS",
                )
            ),
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True,
                metric_name="AWS-AWSManagedRulesKnownBadInputsRuleSet",
                sampled_requests_enabled=True,
            ),
        )

    @staticmethod
    def __rate_list(rate_value: int):
        return wafv2.CfnWebACL.RuleProperty(
            name=f"Custom-RateLimit{rate_value}",
            priority=1,
            action=wafv2.CfnWebACL.RuleActionProperty(block=wafv2.CfnWebACL.BlockActionProperty()),
            statement=wafv2.CfnWebACL.StatementProperty(
                rate_based_statement=wafv2.CfnWebACL.RateBasedStatementProperty(
                    aggregate_key_type="IP",
                    limit=rate_value,
                )
            ),
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True,
                metric_name=f"Custom-RateLimit{rate_value}",
                sampled_requests_enabled=True,
            ),
        )

    @staticmethod
    def __aws_ip_reputation_list():
        return wafv2.CfnWebACL.RuleProperty(
            name="AWS-AWSManagedRulesAmazonIpReputationList",
            priority=0,
            override_action=wafv2.CfnWebACL.OverrideActionProperty(none={}),
            statement=wafv2.CfnWebACL.StatementProperty(
                managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
                    name="AWSManagedRulesAmazonIpReputationList",
                    vendor_name="AWS",
                )
            ),
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True,
                metric_name="AWS-AWSManagedRulesAmazonIpReputationList",
                sampled_requests_enabled=True,
            ),
        )

    @staticmethod
    def __aws_common_rule(aws_common_excluded_rules):
        return wafv2.CfnWebACL.RuleProperty(
            name="AWS-AWSManagedRulesCommonRuleSet",
            priority=2,
            override_action=wafv2.CfnWebACL.OverrideActionProperty(none={}),
            statement=wafv2.CfnWebACL.StatementProperty(
                managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
                    excluded_rules=aws_common_excluded_rules,
                    name="AWSManagedRulesCommonRuleSet",
                    vendor_name="AWS",
                )
            ),
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True,
                metric_name="AWS-AWSManagedRulesCommonRuleSet",
                sampled_requests_enabled=True,
            ),
        )

    @staticmethod
    def __aws_anonymous_list():
        return wafv2.CfnWebACL.RuleProperty(
            name="AWS-AWSManagedRulesAnonymousIpList",
            priority=3,
            override_action=wafv2.CfnWebACL.OverrideActionProperty(none={}),
            statement=wafv2.CfnWebACL.StatementProperty(
                managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
                    name="AWSManagedRulesAnonymousIpList",
                    vendor_name="AWS",
                )
            ),
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True,
                metric_name="AWS-AWSManagedRulesAnonymousIpList",
                sampled_requests_enabled=True,
            ),
        )

    def web_acl(
        self,
        name: str,
        rate_value: Union[int, None],
        aws_common_rule: bool = True,
        aws_common_rule_ignore_list: Optional[list] = None,
        aws_anony_list: bool = False,
        aws_bad_inputs_rule: bool = False,
        aws_sqli_rule: bool = False,
        aws_account_takeover_prevention: Union[bool, Dict[Any, Any]] = False,
        waf_scope: Literal["REGIONAL", "CLOUDFRONT"] = "REGIONAL",
    ) -> wafv2.CfnWebACL:
        """Create AWS WAF with opinionated default rules.

        The minimal configuration will create WAF ACL with aws_reputation_list

        :param aws_common_rule_ignore_list: List of strings that contain rules to be ignored.
        :param aws_account_takeover_prevention: The definition for account takeover prevention rule
        :param aws_sqli_rule: The WAF managed rule by AWS AWS-AWSManagedRulesSQLiRuleSet
        :param aws_bad_inputs_rule: The WAF managed rule by AWS AWS-AWSManagedRulesKnownBadInputsRuleSet
        :param aws_anony_list: The WAF managed rule by AWS AWS-AWSManagedRulesAnonymousIpList
        :param aws_common_rule: The WAF managed rule by AWS AWS-AWSManagedRulesCommonRuleSet
        :param rate_value: The number of packets per seconds for custom rate limiting
        :param waf_scope: The WAF scope, it could be regional for API GW, Cognito and ALB or
        CLOUDFRONT for cloudfront distributions
        :param name: Then name of WAF ACL
        :return:
        """

        # 0. Reputation List. The first rule is enabled by default
        aws_ip_rep_list = self.__aws_ip_reputation_list()
        waf_rules = [aws_ip_rep_list]

        if rate_value:
            # 1. Custom Rate Limit
            rate_list = self.__rate_list(rate_value)
            waf_rules.append(rate_list)

        # 2. Common Rule
        aws_common_excluded_rules = None
        if aws_common_rule_ignore_list:
            aws_common_excluded_rules = [
                wafv2.CfnWebACL.ExcludedRuleProperty(name=rule_name) for rule_name in aws_common_rule_ignore_list
            ]
        if aws_common_rule:
            aws_common_rule = self.__aws_common_rule(aws_common_excluded_rules)
            waf_rules.append(aws_common_rule)

        if aws_anony_list:
            # 3. AnonymousIpList
            aws_anony_list = self.__aws_anonymous_list()
            waf_rules.append(aws_anony_list)

        if aws_bad_inputs_rule:
            # 4. Known Bad Inputs Rule
            aws_bad_inputs_rule = self.__aws_bad_inputs_rule()
            waf_rules.append(aws_bad_inputs_rule)

        if aws_sqli_rule:
            # 5. SQLi Rule
            aws_sqli_rule = self.__aws_sqli_rule()
            waf_rules.append(aws_sqli_rule)

        if aws_account_takeover_prevention:
            # 6. Account takeover prevention
            aws_account_takeover_prevention_rule = self.__aws_account_takeover_prevention(
                aws_account_takeover_prevention
            )
            waf_rules.append(aws_account_takeover_prevention_rule)

        return wafv2.CfnWebACL(
            self,
            "WAF ACL",
            default_action=wafv2.CfnWebACL.DefaultActionProperty(allow={}),
            scope=waf_scope,
            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
                cloud_watch_metrics_enabled=True, metric_name="web-acl", sampled_requests_enabled=True
            ),
            name=name,
            rules=waf_rules,
        )

    def web_acl_association(self, resource_arn, web_acl_arn: str) -> wafv2.CfnWebACLAssociation:
        """Associate AWS Resource with WAF.

        :param resource_arn: The ARN of resource that will be protected by WAF
        :param web_acl_arn: The WEB Application Access Control List ARN
        :return: wafv2.CfnWebACLAssociation
        """
        return wafv2.CfnWebACLAssociation(self, "ACLAssociation", resource_arn=resource_arn, web_acl_arn=web_acl_arn)

    def web_acl_log(self, web_acl_arn: str, log_group_name: str) -> wafv2.CfnLoggingConfiguration:
        """Configure provided a log group as a target for WAF log destination.

        :param web_acl_arn: The WEB Application Access Control List ARN
        :param log_group_name: The name of log group
        :return: AWS CDK WAFv2.CfnLoggingConfiguration
        """
        log_group = logs.LogGroup(
            self,
            id="web_acl_log_group",
            log_group_name=log_group_name,
            retention=logs.RetentionDays.ONE_WEEK,
            removal_policy=cdk.RemovalPolicy.DESTROY,
        )

        return wafv2.CfnLoggingConfiguration(
            self,
            id="web_acl_cfn_log_configuration",
            log_destination_configs=[
                cdk.Stack.of(self).format_arn(
                    arn_format=cdk.ArnFormat.COLON_RESOURCE_NAME,
                    service="logs",
                    resource="log-group",
                    resource_name=log_group.log_group_name,
                )
            ],
            resource_arn=web_acl_arn,
        )

What we can have from it?
Long story short, 5 of AWS managed rules and 1 custom rate limit

AWSManagedRulesAmazonIpReputationList
AWSManagedRulesCommonRuleSet
AWSManagedRulesAnonymousIpList
AWSManagedRulesKnownBadInputsRuleSet
AWSManagedRulesSQLiRuleSet
AWSManagedRulesATPRuleSet
Custom-RateLimit

Example use:

alb_wafv2_construct = WAFv2(self, construct_id="wafv2_construct")

alb_wafv2_acl = alb_wafv2_construct.web_acl(
            name=f"{standard_prefix}-wafv2",
            rate_value=500,
            aws_common_rule=True,
            aws_sqli_rule=True,
            aws_anony_list=True,
            aws_bad_inputs_rule=True,
            aws_account_takeover_prevention={ 
                 "login_path": "/important_page/login",
                 "payload_type": "FORM_ENCODED",
                 "password_field": "PasswordField",
                 "username_field": "LoginField",
             },
        )

alb_wafv2_construct.web_acl_association(resource_arn=alb.load_balancer_arn, web_acl_arn=alb_wafv2_acl.attr_arn)

alb_wafv2_log_group = alb_wafv2_construct.web_acl_log(log_group_name=f"aws-waf-logs-{standard_prefix}-wafv2")

alb_wafv2_construct.web_acl_log_config(log_group=alb_wafv2_log_group, web_acl_arn=alb_wafv2_acl.attr_arn)

And more or less you have a good starting point with WAF ACL attached to your ALB.

Linux EC2 Bastion Host with AWS CDK

Tomasz Szuster — Mon, 05 Sep 2022 08:37:27 +0000

The requirements.

Provide more secure access to the RDS instance for the end users compared to placing database in public network subnet with public IP.

Below solution will use AWS EC2 cloud-init feature to install ansible with required galaxy modules to update /home/ec2-user/.ssh/authorized_keys file whenever a new SSH public key will be placed in public_keys directory.

This way EC2 will be recreated every time when SSH key will be added or removed because cloud-init definition will change.

As this solution depends on ansible then we need to ensure that new key file name will be added to ansible/bastion/roles/ssh/tasks/main.yaml

Below is an example of task main.yaml file:



- name: Gather EC2 metadata facts
  amazon.aws.ec2_metadata_facts:

- name: Set up multiple authorized key taken from files
  ansible.posix.authorized_key:
    user: ec2-user
    state: present
    key: '{{ item }}'
  with_file:
    - public_keys/tom_id_rsa.pub

and below playbook the definition:



---
- hosts: localhost
  connection: local
  remote_user: ec2-user
  become: yes
  become_method: sudo
  gather_facts: yes
  roles:
    - {role: 'ssh'}

The assumptions.

VPC and subnets (public and private)
Route53 DNS public zone
S3 Bucket which hosts ansible playbook
KMS Key (customer managed)

There is ansible playbook in the root dir named /ansible, with below directory structure:




├── ansible
│   └── bastion
│       ├── ansible.cfg
│       ├── main.yml
│       └── roles
│           └── ssh
│               ├── files
│               │   └── public_keys
│               │       └── tom_id_rsa.pub
│               └── tasks
│                   └── main.yaml

Architecture with data flow

The below architecture is coming from article named aws-bastion-host-jump-box

CDK code

Let's import required components from the assumptions section



imported_vpc = ec2.Vpc.from_lookup(
    self,
    id="imported_vpc",
    vpc_id=ssm.StringParameter.value_from_lookup(
        self, parameter_name=self.object_names["vpc_id_ssm_param_name"]
    ),
)
imported_kms_key = kms.Key.from_lookup(
    self, id="imported_kms_key", alias_name=f'alias/{self.object_names["shared_kms_key_alias"]}'
)
imported_route53_public_zone = route53.PublicHostedZone.from_public_hosted_zone_attributes(
    self,
    id="imported_public_hosted_zone_id",
    hosted_zone_id=ssm.StringParameter.value_for_string_parameter(
        self, parameter_name=self.object_names["ssm_public_dns_zone_id"]
    ),
    zone_name=self.object_names["ssm_public_dns_zone_name"],
)

Let's create bastion and grant necessary permissions



bastion = self.bastion_host(
    props=props,
    ansible_bucket=shared_ansible_s3_bucket,
    route53_public_zone=imported_route53_public_zone,
    shared_kms_key=imported_kms_key,
    vpc=imported_vpc,
)
shared_ansible_s3_bucket.grant_read(bastion)
imported_kms_key.grant_decrypt(bastion)

Let's copy ansible playbook to S3



self.bucket_deployment(
    destination_key_prefix="bastion", object_path="../../ansible/bastion", bucket=shared_ansible_s3_bucket
)

Let's have methods for bastion_host and bucket_deployment




def bucket_deployment(self, destination_key_prefix: str, object_path: str, bucket: s3.IBucket) -> None:
    """Deploy directory or zip archive to S3 bucket.

    :param bucket: The AWS S3 Bucket CDK object to which deployment will occur
    :param destination_key_prefix: The prefix which will be used to deploy object into
    :param object_path: Path to the directory or zip archive in filesystem
    :return:
    """
    this_dir = path.dirname(__file__)
    source_asset = s3_deployment.Source.asset(path.join(this_dir, object_path))
    s3_deployment.BucketDeployment(
        self,
        id=f"{destination_key_prefix}_deployment",
        destination_bucket=bucket,
        sources=[source_asset],
        destination_key_prefix=destination_key_prefix,
    )


def bastion_host(
    self,
    props: Dict,
    ansible_bucket: s3.IBucket,
    route53_public_zone: route53.IPublicHostedZone,
    shared_kms_key: kms.IKey,
    vpc: ec2.IVpc,
) -> ec2.BastionHostLinux:
    """Create bastion host to route network traffic (grant access) to the
    resources placed inside private subnets.

    :param ansible_bucket: The CDK instance of existing s3 bucket that host ansible playbooks
    :param route53_public_zone: The CDK object for Route53 zone.
    In this zone the DNS entry for bastion host will be created
    :param props: The dictionary which contain configuration values loaded initially from /config/config-env.yaml
    :param shared_kms_key: The AWS KMS key shared for this project
    :param vpc: The EC2 VPC object, this vpc will be used to place bastion host in it
    """
    ansible_copy_keys_init_list: List[ec2.InitCommand] = []
    ssh_pub_keys_path = "ansible/bastion/roles/ssh/files/public_keys"
    # pylint: disable=W0612
    for dir_path, dirs, files in walk(ssh_pub_keys_path):
        ansible_copy_keys_init_list.extend(
            ec2.InitCommand.shell_command(
                shell_command=f"aws s3 cp s3://{ansible_bucket.bucket_name}/bastion/roles/ssh/files/public_keys/{file_name} /tmp/"
            )
            for file_name in files
        )

    init = ec2.CloudFormationInit.from_config_sets(
        config_sets={
            # Applies the configs below in this order
            "default": [
                "config",
                "yum_packages",
                "ansible_galaxy_modules_installation",
                "ansible_playbook_from_s3",
                "copy_ssh_pub_keys_from_s3",
                "enable_fail2ban",
            ]
        },
        configs={
            "config": ec2.InitConfig(
                [
                    ec2.InitCommand.shell_command(shell_command="yum update -y"),
                    ec2.InitCommand.shell_command(shell_command="amazon-linux-extras install ansible2 -y"),
                    ec2.InitCommand.shell_command(shell_command="amazon-linux-extras install epel -y"),
                ]
            ),
            "yum_packages": ec2.InitConfig(
                [
                    ec2.InitPackage.yum("htop"),
                    ec2.InitPackage.yum("fail2ban"),
                ]
            ),
            "ansible_galaxy_modules_installation": ec2.InitConfig(
                [
                    ec2.InitCommand.shell_command(
                        cwd="/root", shell_command="ansible-galaxy collection install ansible.posix"
                    ),
                    ec2.InitCommand.shell_command(
                        cwd="/root", shell_command="ansible-galaxy collection install amazon.aws"
                    ),
                ]
            ),
            "ansible_playbook_from_s3": ec2.InitConfig(
                [
                    ec2.InitCommand.shell_command(shell_command="mkdir /root/ansible"),
                    ec2.InitCommand.shell_command(
                        shell_command=f"aws s3 cp s3://{ansible_bucket.bucket_name}/bastion /root/ansible/bastion --recursive"
                    ),
                    ec2.InitCommand.shell_command(
                        cwd="/root/ansible/bastion", shell_command="ansible-playbook main.yml"
                    ),
                ]
            ),
            # This section does not implement any real change on Bastion host. It exists only for
            # changing the EC2 cloud-init definition that will force EC2 replacement whenever
            # a new ssh public key file will be added to the repository
            "copy_ssh_pub_keys_from_s3": ec2.InitConfig(ansible_copy_keys_init_list),
            "enable_fail2ban": ec2.InitConfig(
                [
                    ec2.InitCommand.shell_command(shell_command="systemctl enable fail2ban"),
                    ec2.InitCommand.shell_command(shell_command="systemctl start fail2ban"),
                ]
            ),
        },
    )

    init_options = ec2.ApplyCloudFormationInitOptions(
        config_sets=["default"], timeout=cdk.Duration.minutes(30), include_url=True, include_role=True
    )
    security_group = ec2.SecurityGroup(
        self,
        id="bastion_security_group",
        vpc=vpc,
        security_group_name=f'{self.object_names["standard_prefix"]}-bastion',
    )
    security_group.add_ingress_rule(peer=ec2.Peer.any_ipv4(), connection=ec2.Port.tcp(port=22))

    ssm.StringParameter(
        self,
        id="bastion_security_group_id_ssm_param",
        string_value=security_group.security_group_id,
        parameter_name=self.object_names["bastion_security_group_id_ssm_param"],
    )

    bastion = ec2.BastionHostLinux(
        self,
        id="bastion_host",
        block_devices=[
            ec2.BlockDevice(
                device_name="/dev/xvda",
                volume=ec2.BlockDeviceVolume.ebs(
                    volume_size=10,
                    encrypted=True,
                    volume_type=ec2.EbsDeviceVolumeType.GP3,
                    kms_key=shared_kms_key,
                    delete_on_termination=True,
                ),
            )
        ],
        init=init,
        init_options=init_options,
        instance_name=f'{props["stage"]}-{props["project"]}-bastion',
        instance_type=ec2.InstanceType.of(
            instance_class=ec2.InstanceClass.BURSTABLE4_GRAVITON, instance_size=ec2.InstanceSize.MICRO
        ),
        security_group=security_group,
        subnet_selection=ec2.SubnetSelection(
            subnet_group_name="public",
        ),
        vpc=vpc,
    )

    route53.CnameRecord(
        self,
        id="bastion_dns_record",
        domain_name=bastion.instance_public_dns_name,
        record_name=f"bastion.{route53_public_zone.zone_name}",
        zone=route53_public_zone,
        comment="bastion host",
        ttl=cdk.Duration.minutes(1),
    )

    return bastion