I can't SSH onto EC2 instance created using Terraform

Question

I hope everyone that sees this is doing well.

I'm still learning the ropes with Terraform and AWS.

I've created a VPC with 4 subnets in it. 1 subnet is public and the other 3 are private. I currently have 1 EC2 instance in my public subnet (a bastion box/server). I have also created a security group for this instance and have created a NACL rule that allows me to connect via ssh to this instance from my IP only. For some reason when I try to ssh onto this instance my terminal hangs and I see the following message:

OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f 31 Mar 2020

debug1: Reading configuration data /etc/ssh/ssh_config

debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files

debug1: /etc/ssh/ssh_config line 21: Applying options for *

debug1: Connecting to 'instance_public_ip [instance_public_ip] port 22

and then it tells me the connection timed out.

I changed the rule to allow an ssh connection from all IPs (i.e. 0.0.0.0/0) but still get the same problem. The terraform code for the infrastructure is as follows:

# Elastic IP for bastion server
resource "aws_eip" "bastion_eip" {
  instance = aws_instance.Bastion.id
  vpc      = true
}

# EIP association for bastion server
resource "aws_eip_association" "eip_assoc" {
  instance_id   = aws_instance.Bastion.id
  allocation_id = aws_eip.bastion_eip.id
}

# Create internet gateway
resource "aws_internet_gateway" "main-gateway" {
  vpc_id = aws_vpc.main-vpc.id

  tags = {
    Name = "main"
  }
}

# Create route table for public subnet
resource "aws_route_table" "public-route-table" {
  vpc_id = aws_vpc.main-vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main-gateway.id
  }

  tags = {
    Name = "public-route-table"
  }
}

# Create subnet 4
resource "aws_subnet" "subnet-4" {
  vpc_id            = aws_vpc.main-vpc.id
  cidr_block        = "10.0.4.0/24"
  availability_zone = "eu-west-2a"
  tags = {
    Name = "subnet-public"
  }
}

# Associate subnet 4 with public route table
resource "aws_route_table_association" "subnet-4" {
  subnet_id      = aws_subnet.subnet-4.id
  route_table_id = aws_route_table.public-route-table.id
}

# Create bastion server security group (subnet 4)
resource "aws_security_group" "bastion-sg" {
  name        = "bastion-sg"
  description = "Allow web traffic from specific IPs"
  vpc_id      = aws_vpc.main-vpc.id

  # SSH Traffic
  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] #allow web traffic.
  }

  egress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "allow_access_bastion_server"
  }
}

# Create NACL for public subnet with Prod server & bastion server
resource "aws_network_acl" "public_nacl" {
  vpc_id     = aws_vpc.main-vpc.id
  subnet_ids = [aws_subnet.subnet-4.id]

  # Allow inbound http traffic from internet
  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 80
    to_port    = 80
  }

  # Allow outbound http traffic to internet
  egress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 80
    to_port    = 80
  }

  # Allow inbound SSH traffic from specific IP
  ingress {
    protocol   = "tcp"
    rule_no    = 103
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 22
    to_port    = 22
  }

  # Allow outbound SSH traffic from specific IP
  egress {
    protocol   = "tcp"
    rule_no    = 103
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 22
    to_port    = 22
  }

  tags = {
    Name = "public NACL"
  }

}

# Create bastion box 
resource "aws_instance" "Bastion" {
  ami                    = var.ami-id
  instance_type          = var.instance-type
  key_name               = "aws_key_name"
  vpc_security_group_ids = ["security_group_id"]
  subnet_id              = "subnet_id"

  tags = {
    Name = "Bastion Server"
  }
}

I've been looking at this a while now and can't really see where I've gone wrong. Is the issue with my security group or my IGW or route table? If there's any other information you feel is needed let me know :) and thanks for any help in advance

Answer 1

I think the problem is on the security group.

# SSH Traffic
ingress {
  description = "SSH"
  from_port   = 0  # SSH client port is not a fixed port
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"] #allow web traffic. 46.64.73.251/32
}

egress {
  from_port   = 22
  to_port     = 0  # SSH client port is not a fixed port
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
}