A Lightsail Instance with a Firewall that Names Its Sources, a Static IP and Snapshots
A Lightsail instance is created with 22 and 80 open to every address; its public address changes when it stops unless a static IP is attached, and every DNS record pointing at it is then wrong; and automatic snapshots are off. The port list replaced by your rules with SSH from anywhere accepted by name, a static IP attached, and the daily AutoSnapshot add-on on at the hour you choose.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "lightsail_instance" {
source = "www.iac-bazaar.com/iac-bazaar/aws-lightsail-instance/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-lightsail-instance
A Lightsail instance with a firewall that names its sources, a static
address, and automatic snapshots. Works with Terraform and OpenTofu
(>= 1.6), aws provider >= 6.0, < 7.0.
The default firewall opens 22 and 80 to the world. Replaced by your
rules; 22 from anywhere needs accept_ssh_from_anywhere.
The public address changes on stop without a static IP; one is attached.
Automatic snapshots are off by default; on here at
snapshot_time_utc.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-image-builder
A pipeline with no schedule builds when somebody clicks, so the golden image ages until a person remembers it; image tests are the switch turned off to save an hour and scanning is off unless enabled; and the build instance's metadata service can hand its credentials to whatever a step downloads. Weekly rebuilds when a dependency changed, tests and scanning on, IMDSv2-only builds.
aws-ssm-patch-manager
A patch baseline that approves security patches after a delay, the patch group that binds instances to it by tag, and a maintenance window that runs AWS-RunPatchBaseline on a schedule with the output in CloudWatch. Install rather than Scan (scan-only by name), RebootIfNeeded, and unapproved security updates counted as non-compliant so the approval delay shows on the dashboard.
aws-batch
Batch does not retry by default, so a reclaimed spot instance or a timed-out image pull ends as FAILED - reported as if the job failed on its merits, which is how somebody ends up debugging working code. Retries infrastructure failures and exits on real ones.
aws-ec2-instance
EC2 instance with IMDSv2, encrypted EBS, instance profile, and EIP - secure defaults out of the box.
aws-autoscaling
EC2 launch template and Auto Scaling group with IMDSv2 enforced, encrypted gp3 root volume, an egress-only security group, and scale-to-zero defaults so it applies cleanly with no compute cost.
azure-vmss
A self-contained Linux VM Scale Set (Uniform orchestration) on Azure - one apply creates the resource group, VNet, subnet, NSG and an SSH-key-only scale set with deny-all-inbound and no public IPs.