cdk-tailscale-bastion
This packages creates an AWS Bastion configured for Tailscale. This covers steps 1,2 & 4 of the Tailscale RDS guide.
You may find this package useful if you need high performance access to internal resources (ie RDS) without the overhead & limitations of Session Manager.
Installation
npm i cdk-tailscale-bastion -D
Instructions
The Tailscale Auth key should be passed in via parameter store or secrets manager and NOT hardcoded in your application.
import { TailscaleBastion } from 'cdk-tailscale-bastion';
// Secrets Manager
const secret = Secret.fromSecretNameV2(stack, 'ApiSecrets', 'tailscale').secretValueFromJson('AUTH_KEY');
// Systems Manager Parameter Store
const altSecret = SecretValue.ssmSecure('/tsauth');
new TailscaleBastion(stack, 'Sample-Bastion', {
vpc,
tailScaleAuthKey: secret,
});
Whatever resource you intend to reach should permit connections from the bastion on the relevant port, naturally.
Tailscale Auth Key
I recommend generating an Ephemeral key that includes the bastion as a tag for ease of teardown and tracking:
Tailscale Configuration
Once deployed, unless you have auto approval enabled, you'll need to manually enable the subnet routes in the tailscale console.
You'll also need to setup the nameserver. The bastion construct conveniently outputs the settings you require for Tailscale's DNS configuration:
Given your configuration is correct, a direct connection to your internal resources should now be possible.
4 Nov 16, 2022
89 Dec 20, 2022
89 Jan 3, 2023
165 Dec 21, 2022
35 Dec 17, 2022
3 May 18, 2022
4 May 3, 2022
14 Jan 3, 2023
58 Dec 30, 2022
7 Oct 8, 2022