AWS security harding, allow disabling internet gateway (#141)

* add bastion host source ip restrictions
* rename: dev-box->bastion-host
* allow disabling internet gateway
* misc cleanup

Author: Aaron Steers

Diff for: catalog/README.md

@@ -1,16 +1,16 @@
 /*
-* The `dev-box` catalog module deploys an ECS-backed container which can be used to remotely test
-* or develop using the native cloud environment. Applicable use cases include:
+* The `bastion-host` module deploys an ECS-backed container which can be used to remotely test
+* or develop using the native cloud environment.
 *
-* * Debugging network firewall and routing rules
-* * Debugging components which can only be run from whitelisted IP ranges
-* * Offloading heavy processing from the developer's local laptop
-* * Mitigating network relability issues when working from WiFi or home networks
+* Applicable use cases include:
+*
+* - Debugging network firewall and routing rules
+* - Debugging components which can only be run from whitelisted IP ranges
+* - Offloading heavy processing from the developer's local laptop
+* - Mitigating network relability issues when working from WiFi or home networks
 *
 */
 
-data "aws_availability_zones" "az_list" {}
-
 locals {
   name_prefix = "${var.name_prefix}devbox-"
   # container_command = ()
@@ -40,8 +40,9 @@ module "ecs_bastion_task" {
     SSH_PUBLIC_KEY_BASE64 = local.ssh_public_key_base64
   })
   environment_secrets = var.secrets
-  app_ports           = ["22"]
+  app_ports           = []
   admin_ports         = ["22"]
+  admin_cidr          = var.admin_cidr
 }
 
 module "ecr_image" {

Diff for: catalog/aws/bastion-host/main.tf

@@ -90,3 +90,8 @@ variable "aws_credentials_file" {
   description = "Path to the AWS credentials file, used to ensure that the correct credentials are used during upload of the ECR image."
   type        = string
 }
+variable "admin_cidr" {
+  description = "List of source IP CIDR blocks which should be allowed to connect to the bastion host."
+  type        = list(string)
+  default     = null
+}

Diff for: catalog/aws/bastion-host/variables.tf

@@ -4,9 +4,6 @@
 *
 */
 
-data "aws_availability_zones" "az_list" {}
-data "aws_region" "current" {}
-
 locals {
   name_prefix = "${var.name_prefix}DBT-"
   admin_cidr  = var.admin_cidr