A Bastion That Says Out Loud What Owning It Does Not Do
A Bastionhost instance, its exposure and the directory its operators come from. Public access with an empty allow list is refused: that is a login page for production. Without AD or LDAP every account is local and outlives the person who left. Destroying it needs Alibaba to white-list the account first, which is documented provider behaviour and reported as an output.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "bastion" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-bastion/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-bastion
A bastion host appliance on Alibaba Cloud Bastionhost. Works with Terraform and OpenTofu
(>= 1.6), alicloud provider >= 1.0, < 2.0.
The appliance is not the control. Until a security group on the targets refuses everything except the bastion, and until hosts and accounts are registered on it, you own an audit trail of the sessions nobody is having. enforces_access_on_its_own says false out loud.
Public access with an empty allow list is refused. It publishes the console and the connection gateway to the internet, which is a login page for your production estate.
You cannot destroy this without asking Alibaba first. Releasing a Bastionhost instance needs the account on a white list, applied for through support - so terraform destroy fails, and it fails after the plan has already taken down whatever it reached first. That is documented provider behaviour and destroy_needs_alibaba_approval reports it.
period is write-once and a later change is silently ignored, with apply still reporting success. initial_term_months is the value in the file, not a promise about the account.
The directory decides who can log in. Without AD or LDAP every operator account is local to the appliance and outlives the person who left - on the one account where that matters most.
The auth server password will fight your plan. Alibaba never returns it, so every plan wants to set it again. The provider's own advice is to ignore it; this module does not do that for you, because the same block also carries the server address. If you want the provider's behaviour, add it at the call site:
lifecycle {
ignore_changes = [ldap_auth_server]
}
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-ram-role
A RAM role assumable by the services or accounts you name and nothing else (a wildcard principal is refused), with a custom policy written from your statements, the system policies you name attached (AdministratorAccess and any *FullAccess policy by name), and a session ceiling of an hour.
alicloud-security-group
inner_access_policy defaults to Accept, so every instance in a group talks to every other on every port and one compromised web node is a route to the database beside it; SSH from 0.0.0.0/0 is the first rule offered; and the group is attached by the instance, which it cannot see. Members isolated unless told otherwise, SSH from anywhere refused unless accepted, egress open until rules narrow it.
alicloud-security-posture
Security Center defence rules and baseline checks. A rule naming no servers defends nothing while Alibaba's default keeps running, so it is refused. The block-forever value is 52560000 minutes sitting at the end of a list of ordinary numbers, so the module takes words. SQL Server interception is off by default, which is where the interesting passwords are.
alicloud-network-firewall
Address books and control policies with their evaluation order declared, since the list is read top down and a broad accept above a narrow drop silently disables it. The intrusion prevention engine ships in observation mode, where it inspects, logs and blocks nothing while every dashboard looks right; block is the default here. Rules whose action is log are counted and reported.
alicloud-waf
WAF 3.0 in front of a domain on the pay-as-you-go instance the account has (adopted, not purchased), listening on HTTPS only with your certificate (plain HTTP by name), TLS 1.2 and 1.3 with a modern cipher suite, HTTP/2 and IPv6, the client address trusted from the first X-Forwarded-For hop, and origins reached over HTTPS with SNI, keepalive and retries.
tencent-bastion
A Tencent Bastion Host deployment. cidr_block is a range the service claims inside your VPC and an overlap is found by whatever stops working, not by the plan. resource_node is both the bill and the ceiling: registering more assets than you bought fails at registration, months later. time_unit is months and nothing else.