How cyber-hen/vpc-provisioning works
Purpose and entry point
This is a Terraform Infrastructure-as-Code repository that provisions an AWS VPC topology with public and private subnets, Ubuntu EC2 instances, and a bastion-mediated SSH access model. The operational entry point is Terraform: terraform init and terraform apply from the repository root.
Terraform and AWS boundary
Terraform is the control plane and AWS is the target runtime. Provider configuration, including the AWS provider and deployment region/credentials integration, is defined in provider.tf. Infrastructure state is managed by Terraform and should be treated as environment-specific deployment state rather than application data.
Network foundation
vpc.tf establishes the primary network boundary: the VPC, subnet segmentation, and associated routing resources. The public subnet is intended to have internet reachability through an Internet Gateway and public route table; the private subnet is isolated from direct internet routing.
Public access tier and bastion
The public Ubuntu EC2 instance is defined in ec2.tf and serves two roles: directly reachable workload and bastion host. Its security group permits SSH plus web traffic (ports 22, 80, and 443), while public-subnet routing provides the path to the Internet Gateway configured through vpc.tf.
Private workload tier
A second Ubuntu EC2 instance in ec2.tf is placed in the private subnet. Its intended ingress boundary permits SSH only from the public instance’s security group, not arbitrary public IP addresses. This makes the public EC2/security-group relationship the critical trust boundary for administrative access.
Primary access flow
1. Internet-originated SSH reaches the public instance through public-subnet routing and its security group.
2. An operator uses the public instance as an SSH jump host.
3. SSH traffic to the private instance is authorized based on the public instance’s security-group identity.
4. The private instance has no direct public internet path.
Main implementation surfaces
• AWS provider/deployment configuration: provider.tf
• VPC, subnets, Internet Gateway, routes, and network associations: vpc.tf
• Ubuntu instances, key-pair attachment, and security-group/instance placement: ec2.tf
The repository is infrastructure-only: there is no application runtime, API service, or web frontend. AWS EC2, VPC networking, Internet Gateway routing, security groups, and an existing AWS SSH key pair are the material external dependencies.
Components 15
Terraform control plane
- Terraform CLI · Runs init and apply from the repository root.
- AWS provider config
provider.tf - Deployment state · Environment-specific infrastructure state.
AWS network
- AWS
- VPC
vpc.tf - Public subnet
vpc.tf - Private subnet · Has no direct public internet route.
vpc.tf - Internet Gateway
vpc.tf - Public routing · Routes the public subnet through the Internet Gateway.
vpc.tf
AWS compute and access
- Public security group · Allows SSH and web traffic on ports 22, 80, and 443.
ec2.tf - Private security group · Allows SSH only from the public security group.
ec2.tf - Existing SSH key pair
ec2.tf - Public Ubuntu EC2 · Directly reachable host and SSH jump host.
ec2.tf - Private Ubuntu EC2
ec2.tf
Other components
- Internet operator
Connections 19
- Terraform CLI → AWS provider config: loads
- AWS provider config → AWS: provisions in
- Terraform CLI → Deployment state: reads and updates
- AWS → VPC: contains
- VPC → Public subnet: segments
- VPC → Private subnet: segments
- VPC → Internet Gateway: attaches
- Public subnet → Public routing: uses
- Public routing → Internet Gateway: routes through
- Public subnet → Public Ubuntu EC2: places
- Private subnet → Private Ubuntu EC2: places
- Public security group → Public Ubuntu EC2: protects
- Private security group → Private Ubuntu EC2: protects
- Existing SSH key pair → Public Ubuntu EC2: attaches to
- Existing SSH key pair → Private Ubuntu EC2: attaches to
- Internet operator → Internet Gateway: SSH and web ingress
- Internet Gateway → Public Ubuntu EC2: public reachability
- Public Ubuntu EC2 → Private Ubuntu EC2: SSH jump-host access
- Public security group → Private security group: authorized SSH source