Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita807e68

Browse files
committed
Enhances security and clarifies access options
Improves security by emphasizing SSH tunnel access as the default and most secure option.Clarifies configuration for Grafana and internal service port binding.Provides detailed instructions for accessing Grafana via SSH tunnel or direct access.
1 parentb17accf commita807e68

File tree

4 files changed

+108
-28
lines changed

4 files changed

+108
-28
lines changed

‎terraform/aws/QUICKSTART.md‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,15 @@ Uncomment and set all required parameters:
2929
-`instance_type` - EC2 instance type (e.g., t3.medium)
3030
-`data_volume_size` - data disk size in GiB
3131
-`data_volume_type` /`root_volume_type` - volume types (gp3, st1, sc1)
32-
-`allowed_ssh_cidr` /`allowed_cidr_blocks` - CIDR blocks for access
32+
-`allowed_ssh_cidr` - CIDR blocks for SSH access (use`["YOUR_IP/32"]`, get IP:`curl ifconfig.me`)
33+
-`allowed_cidr_blocks` - CIDR blocks for Grafana (use`[]` for SSH tunnel only - most secure)
3334
-`use_elastic_ip` - allocate Elastic IP (true/false)
3435
-`grafana_password` - Grafana admin password
35-
-`postgres_ai_version` - git branch/tag (optional, defaults to "main")
36+
-`bind_host` - port binding for internal services (use`"127.0.0.1:"`)
37+
38+
Optional parameters:
39+
-`grafana_bind_host` - Grafana port binding (defaults to`"127.0.0.1:"` for SSH tunnel)
40+
-`postgres_ai_version` - git branch/tag (defaults to "0.9")
3641

3742
##Add monitoring instances
3843

@@ -70,12 +75,30 @@ terraform output ssh_command
7075

7176
##Access
7277

78+
###Grafana
79+
80+
**If`allowed_cidr_blocks = []` (SSH tunnel, most secure):**
81+
82+
```bash
83+
# Create SSH tunnel
84+
ssh -i~/.ssh/postgres-ai-key.pem -L 3000:localhost:3000 ubuntu@$(terraform output -raw external_ip)
85+
86+
# Open browser
87+
open http://localhost:3000
88+
# Login: monitor / <password from terraform.tfvars>
89+
```
90+
91+
**If`allowed_cidr_blocks = ["YOUR_IP/32"]` (direct access):**
92+
7393
```bash
7494
# Grafana dashboard
7595
open$(terraform output -raw grafana_url)
7696
# Login: monitor / <password from terraform.tfvars>
97+
```
98+
99+
###SSH
77100

78-
# SSH
101+
```bash
79102
ssh -i~/.ssh/postgres-ai-key.pem ubuntu@$(terraform output -raw external_ip)
80103
```
81104

‎terraform/aws/README.md‎

Lines changed: 66 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -49,19 +49,22 @@ instance_type = "t3.medium"
4949
data_volume_size = 50
5050
data_volume_type = "gp3" # gp3 (SSD), st1 (HDD), sc1 (HDD)
5151
root_volume_type = "gp3"
52-
allowed_ssh_cidr = ["203.0.113.0/24"]
53-
allowed_cidr_blocks = ["203.0.113.0/24"]
52+
allowed_ssh_cidr = ["YOUR_IP/32"] # Replace with your actual IP address
53+
allowed_cidr_blocks = [] # Empty for SSH tunnel only (most secure)
5454
use_elastic_ip = true
5555
grafana_password = "YourSecurePassword123!"
56+
bind_host = "127.0.0.1:" # Bind internal services to localhost
5657
```
5758

5859
###Optional parameters
5960

6061
```hcl
6162
# OPTIONAL (have defaults)
62-
postgres_ai_api_key = "your-api-key" # For uploading reports
63-
enable_demo_db = false # Demo database (default: true)
64-
postgres_ai_version = "main" # Git branch/tag (default: "main")
63+
postgres_ai_api_key = "your-api-key" # For uploading reports
64+
enable_demo_db = false # Demo database (default: false)
65+
postgres_ai_version = "0.9" # Git branch/tag (default: "0.9")
66+
grafana_bind_host = "127.0.0.1:" # Grafana on localhost only (default, use SSH tunnel)
67+
# grafana_bind_host = "" # OR: Grafana accessible from outside
6568
6669
monitoring_instances = [
6770
{
@@ -85,15 +88,17 @@ instance_type = "t3.medium"
8588
data_volume_size = 100
8689
data_volume_type = "gp3"
8790
root_volume_type = "gp3"
88-
allowed_ssh_cidr = ["203.0.113.0/24"]
89-
allowed_cidr_blocks = ["203.0.113.0/24"]
91+
allowed_ssh_cidr = ["YOUR_IP/32"] # Replace with your actual IP
92+
allowed_cidr_blocks = [] # SSH tunnel only (most secure)
9093
use_elastic_ip = true
9194
grafana_password = "SecurePassword123!"
95+
bind_host = "127.0.0.1:"
9296
9397
# OPTIONAL
9498
postgres_ai_api_key = "your-api-key"
9599
enable_demo_db = false
96-
postgres_ai_version = "v0.9"
100+
postgres_ai_version = "0.9"
101+
grafana_bind_host = "127.0.0.1:" # Default, SSH tunnel only
97102
98103
monitoring_instances = [
99104
{
@@ -116,6 +121,30 @@ terraform output ssh_command
116121
ssh -i~/.ssh/postgres-ai-key.pem ubuntu@$(terraform output -raw external_ip)
117122
```
118123

124+
###Grafana access
125+
126+
**Option 1: SSH tunnel (default, most secure)**
127+
128+
When`allowed_cidr_blocks = []`:
129+
130+
```bash
131+
# Create SSH tunnel
132+
ssh -i~/.ssh/postgres-ai-key.pem -L 3000:localhost:3000 ubuntu@$(terraform output -raw external_ip)
133+
134+
# Open browser
135+
open http://localhost:3000
136+
# Login: monitor / <your grafana_password>
137+
```
138+
139+
**Option 2: Direct access**
140+
141+
When`allowed_cidr_blocks = ["YOUR_IP/32"]`:
142+
143+
```bash
144+
# Open browser
145+
open$(terraform output -raw grafana_url)
146+
```
147+
119148
###Service management
120149

121150
```bash
@@ -176,14 +205,25 @@ sudo docker-compose up -d
176205

177206
###Recommendations
178207

179-
1.RestrictSSHaccess:
208+
1.**Most secure setup (SSHtunnel only)**:
180209
```hcl
181-
allowed_ssh_cidr = ["your.ip.address/32"]
210+
allowed_ssh_cidr = ["your.ip.address/32"]
211+
allowed_cidr_blocks = [] # No direct Grafana access
212+
bind_host = "127.0.0.1:"
213+
grafana_bind_host = "127.0.0.1:"
214+
```
215+
216+
Access Grafana via SSH tunnel:
217+
```bash
218+
ssh -i~/.ssh/key.pem -L 3000:localhost:3000 ubuntu@instance-ip
182219
```
183220

184-
2.RestrictGrafana access:
221+
2.**Production with directGrafana access**:
185222
```hcl
186-
allowed_cidr_blocks = ["your.office.ip/24"]
223+
allowed_ssh_cidr = ["YOUR_OFFICE_IP/24"] # Replace with your office network
224+
allowed_cidr_blocks = ["YOUR_OFFICE_IP/24"] # Replace with your office network
225+
bind_host = "127.0.0.1:" # Internal services protected
226+
grafana_bind_host = "" # Grafana accessible
187227
```
188228

189229
3. Use AWS Systems Manager instead of SSH:
@@ -193,6 +233,13 @@ aws ssm start-session --target $(terraform output -raw instance_id)
193233

194234
4. Automate backups with AWS Backup or cron.
195235

236+
###Port binding configuration
237+
238+
-`bind_host = "127.0.0.1:"` - Internal services only on localhost (recommended)
239+
-`bind_host = ""` - Internal services on all interfaces
240+
-`grafana_bind_host = "127.0.0.1:"` - Grafana only via SSH tunnel (default)
241+
-`grafana_bind_host = ""` - Grafana accessible from network
242+
196243
##Monitoring
197244

198245
###CloudWatch metrics
@@ -231,6 +278,13 @@ ssh ubuntu@your-ip "sudo docker ps -a"
231278
###No access to Grafana
232279

233280
```bash
281+
# Check if allowed_cidr_blocks is empty (SSH tunnel required)
282+
grep allowed_cidr_blocks terraform.tfvars
283+
284+
# If empty, use SSH tunnel
285+
ssh -i~/.ssh/key.pem -L 3000:localhost:3000 ubuntu@your-ip
286+
# Then open http://localhost:3000
287+
234288
# Check Security Group
235289
aws ec2 describe-security-groups \
236290
--group-ids$(terraform output -raw security_group_id)

‎terraform/aws/terraform.tfvars.example‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,35 +26,37 @@
2626
# Grafana admin password
2727
# grafana_password = "YourSecurePassword123!"
2828

29-
# CIDR blocks for SSH access (restrict to your IP in production)
29+
# CIDR blocks for SSH access
30+
# Get your IP: curl ifconfig.me
3031
# allowed_ssh_cidr = [
31-
# "0.0.0.0/0" # WARNING: Allows access from anywhere
32-
# # "203.0.113.0/24"#Replace withyour office/VPN IP
32+
# "0.0.0.0/0"# WARNING: Allows access from anywhere - NOT RECOMMENDED
33+
# # "1.2.3.4/32" # RECOMMENDED:Replace withYOUR actual IP address
3334
# ]
3435

35-
# CIDR blocks for Grafana access (restrict to your IP in production)
36+
# CIDR blocks for Grafana access
3637
# allowed_cidr_blocks = [
37-
# "0.0.0.0/0" # WARNING: Allows access from anywhere
38-
# # "203.0.113.0/24" # Replace withyour office/VPN IP
38+
# "0.0.0.0/0"# WARNING: Allows access from anywhere - NOT RECOMMENDED
39+
# # "1.2.3.4/32"# Replace withYOUR actual IP (or leave empty [] for SSH tunnel)
3940
# ]
4041

4142
# Allocate Elastic IP for stable address
4243
# use_elastic_ip = true
4344

45+
# Port binding configuration
46+
# bind_host = "127.0.0.1:" # Bind internal services to localhost only (most secure, recommended)
47+
# bind_host = "" # OR: Bind to all interfaces (needed if accessing services remotely)
48+
49+
# grafana_bind_host = "127.0.0.1:" # Grafana only via SSH tunnel (default, most secure)
50+
# grafana_bind_host = "" # OR: Grafana accessible from outside (controlled by Security Group)
51+
52+
4453

4554
# OPTIONAL PARAMETERS
4655
# -------------------------
4756

4857
# postgres_ai version (optional, defaults to actual)
4958
# postgres_ai_version = "0.9" # branch or specific tag like "0.9"
5059

51-
# Port binding configuration (required)
52-
# bind_host = "127.0.0.1:" # Bind internal services to localhost only (most secure)
53-
# bind_host = "" # Bind to all interfaces (needed if accessing services remotely)
54-
55-
# grafana_bind_host = "" # Grafana accessible from outside (controlled by Security Group)
56-
# grafana_bind_host = "127.0.0.1:" # Grafana only via SSH tunnel
57-
5860
# PostgreSQL instances to monitor (optional, can be empty for initial setup)
5961
# monitoring_instances = [
6062
# {

‎terraform/aws/variables.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,5 +93,6 @@ variable "bind_host" {
9393
variable"grafana_bind_host" {
9494
description="Bind host for Grafana port (127.0.0.1: for localhost only, empty for all interfaces)"
9595
type=string
96+
default="127.0.0.1:"
9697
}
9798

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp