This module creates an auto-scaling instance group and a TCP load balancer in Google Cloud (GCP) for a Banyan Access Tier. A network load balancer forwards traffic to the instance group which, when added to the proper tags and banyan zero trust policies, allows for connections to internal services or to the network via service tunnel.

This module will create an access tier definition in the Banyan API, and an access_tier scoped API key. It will populate the launch configuration of all instances in the auto-scaling group with a short script to download the latest version of the Banyan NetAgent (or a pinned version if set), install it as a service, and launch the netagent with the API key and access tier configuration name for your Banyan organization.

In order to ease the installation and configuration of the access tier, the new netagent only needs an access tier scoped API key, Banyan API URL, and the name of an access tier configuration in order to successfully connect. In this new module the access tier is defined in the Banyan API with the banyan_accesstier resource from the banyan terraform provider. The API key is created specifically for the access tier and added to the launch configuration

terraform {
  required_providers {
    banyan = {
      source  = "banyansecurity/banyan"
      version = "1.0.0"
    }
  }
}

provider "banyan" {
  api_key = "ADMIN-SCOPE-API-KEY"
}

provider "google" {
  project = "my-gcloud-project"
  region  = "us-west1"
}

module "gcp_accesstier" {
  source                   = "banyansecurity/banyan-accesstier2/google"
  name                     = "example"
  project                  = "example-project"
  region                   = "us-west1"
  network                  = "us-west1"
  subnetwork               = "us-west1-external"
  tags                     = ["allow-accesstier"]
  tunnel_cidrs             = ["10.10.0.0/24"]
}

This example will configure the Banyan terraform provider and the Google Cloud provider. It will then create an access tier with a wildcard DNS record pointing to the address of the access tier. The access tier is configured with the tunnel CIDR of 10.10.0.0/16. This corresponds to CIDR of the private network(s) (the entire VPC or individual subnets in Google Cloud). A service tunnel is configured to use this access tier, with a policy which allows any user with a High trust level access to the service tunnel.

This policy could be narrowed down further using the access.l4_access attribute of the banyan_policy_tunnel resource.

This is an effective replacement of a VPN tunnel, which leverages the device trust, continuous authorization and SAML capabilities of Banyan.

terraform {
  required_providers {
    banyan = {
      source  = "banyansecurity/banyan"
      version = "1.0.0"
    }
  }
}

provider "banyan" {
  api_key = "ADMIN-SCOPE-API-KEY"
}

provider "google" {
  project = "my-gcloud-project"
  region  = "us-west1"
}

module "gcp_accesstier" {
  source                   = "banyansecurity/banyan-accesstier2/google"
  name                     = "example"
  project                  = "example-project"
  region                   = "us-west1"
  network                  = "us-west1"
  subnetwork               = "us-west1-external"
  tags                     = ["allow-accesstier"]
  tunnel_cidrs             = ["10.10.0.0/16"]
}

resource "banyan_service_tunnel" "example" {
  name        = "example-anyone-high"
  description = "tunnel allowing anyone with a high trust level"
  access_tier = module.gcp_accesstier.name
  policy      = banyan_policy_infra.anyone-high.id
}

resource "banyan_policy_tunnel" "anyone-high" {
  name        = "allow-anyone-high-trust"
  description = "${module.gcp_accesstier.name} allow"
  access {
    roles       = ["ANY"]
    trust_level = "High"
  }
}

resource "google_dns_record_set" "frontend" {
  name = "*.${module.gcp_accesstier.name}.mycompany.com"
  type = "A"
  ttl  = 300
  managed_zone = google_dns_managed_zone.prod.name
  rrdatas = module.gcp_accesstier.address
}

Set netagent_version to the desired version number. This will ensure all instances are pinned to the same version number. If netagent_version is not specified, each instance will automatically install the latest version.

• The default value for management_cidr leaves SSH closed to instances in the access tier.

• The current recommended setup for to use a banyan SSH service to SSH to a host inside the private network, which in turn has SSH access to the instances in the auto-scaling group. This way no SSH service is exposed to the internet.

No modules.

[
  "0.0.0.0/0"
]