discriminat-eni
ChaserSystems/discriminat-eni/aws
DiscrimiNAT Firewall for egress filtering by FQDNs on AWS. Architecture with ENIs in VPCs for Private Subnets' route table entries to the Internet.
DiscrimiNAT, ENI architecture DiscrimiNAT Firewall for egress filtering by FQDNs on AWS. Just specify the allowed destination hostnames in the respective applications' native Security Groups and the firewall will take care of the rest.  Architecture with ENIs in VPCs for Private Subnets' route table entries to the Internet. Demo Video | DiscrimiNAT FAQ Pentest Ready DiscrimiNAT enforces the use of contemporary encryption standards such as TLS 1.2+ and SSH v2 with bidirectional in-band checks. Anything older or insecure will be denied connection automatically. Also conducts out-of-band checks, such as DNS, for robust defence against sophisticated malware and insider threats. Gets your VPC ready for a proper pentest! Highlights Creates E
| Name | Type | Description | Default |
|---|---|---|---|
| public_subnets | list(string) | The IDs of the Public Subnets to deploy the DiscrimiNAT Firewall instances in. T | |
| ami_version | string | Reserved for use with Chaser support. Allows overriding the source AMI version f | "2.20" |
| iam_get_additional_ssm_params | list(string) | A list of additional SSM Parameters' full ARNs to apply the `ssm:GetParameter` A | [] |
| ashr | bool | Automated System Health Reporting. See note in README to learn more. Set to fals | true |
| key_pair_name | string | Strongly suggested to leave this to the default, that is to NOT associate any ke | null |
| user_data_base64 | string | Strongly suggested to NOT run custom, startup scripts on the firewall instances. | null |
| ami_owner | string | Reserved for use with Chaser support. Allows overriding the source AMI account f | "aws-marketplace" |
| ami_auto_update | bool | Automatically look up and use the latest version of DiscrimiNAT image available | true |
| iam_get_additional_secrets | list(string) | A list of additional Secrets' full ARNs (in Secrets Manager) to apply the `secre | [] |
| byol | string | If using the BYOL version from the marketplace, supply the licence key as suppli | null |
| preferences | string | Default preferences. See docs at https://chasersystems.com/docs/discriminat/aws/ | "{\n \"%default\": {\n \"wildcard_ex |
| tags | map(any) | Map of key-value tag pairs to apply to resources created by this module. See exa | {} |
| instance_size | string | The default of t3.small should suffice for light to medium levels of usage. Anyt | "t3.small" |
cloudwatch_log_group_name — Name of the CloudWatch Log Group where DiscrimiNAT instances will log traffic flow and configurationtarget_network_interfaces — Map of zones to ENI IDs suitable for setting as Network Interface targets in routing tables of PrivaAzure landing zones Terraform module
Terraform supermodule for the Terraform platform engineering for Azure
Terraform module to deploy landing zone subscriptions (and much more) in Azure
Terraform Module to define a consistent naming convention by (namespace, stage,