Create an ec2 into a private subnet and connect to them via SSM

ephemeral-ec2.tf

variable "vpc_id" {
  type = string
}

variable "subnet_id" {
  type = string
}

data "aws_region" "current" {}

data "aws_vpc" "this" {
  id = var.vpc_id
}

resource "aws_security_group" "ssm_endpoint" {
  name        = "ssm-vpc-endpoint"
  description = "Traffic related to VPC Endpoint"
  vpc_id      = var.vpc_id

  ingress {
    description = "TLS from EC2"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [data.aws_vpc.this.cidr_block]
  }

  egress {
    description = "Allow All Egress"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "ssm_ec2" {
  name        = "ssm-ec2"
  description = "Traffic related to EC2 instance"
  vpc_id      = var.vpc_id

  egress {
    description = "Allow All Egress"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

data "aws_iam_policy_document" "ec2_assume_role" {
  statement {
    sid = "LetEC2AssumeRole"

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

    actions = [
      "sts:AssumeRole"
    ]
  }
}

resource "aws_iam_role" "ec2" {
  name               = "ssm_role"
  assume_role_policy = data.aws_iam_policy_document.ec2_assume_role.json
}

resource "aws_iam_instance_profile" "ec2" {
  name = "ssm_instance_profile"
  role = aws_iam_role.ec2.name
}

resource "aws_iam_role_policy_attachment" "ssm_attachment" {
  role       = aws_iam_role.ec2.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

locals {
  endpoint_services = ["ssm", "ssmmessages", "ec2messages"]
}

resource "aws_vpc_endpoint" "this" {
  for_each = toset(local.endpoint_services)
  vpc_id   = var.vpc_id

  service_name      = "com.amazonaws.${data.aws_region.current.name}.${each.key}"
  vpc_endpoint_type = "Interface"

  private_dns_enabled = true

  security_group_ids = [
    aws_security_group.ssm_endpoint.id,
  ]

  subnet_ids = [
    var.subnet_id
  ]
}

data "aws_ami" "amazon_linux_2" {
  most_recent = true


  filter {
    name   = "owner-alias"
    values = ["amazon"]
  }


  filter {
    name   = "name"
    values = ["amzn2-ami-hvm*"]
  }
}

resource "aws_instance" "ec2" {
  ami = data.aws_ami.amazon_linux_2.id

  depends_on = [
    aws_vpc_endpoint.this,
    aws_iam_role_policy_attachment.ssm_attachment
  ]

  instance_type = "t2.micro"

  security_groups             = [aws_security_group.ssm_ec2.id]
  subnet_id                   = var.subnet_id
  iam_instance_profile        = aws_iam_instance_profile.ec2.name
  associate_public_ip_address = false
}