How to connect to JIRA aws quickstart ec2 server without bastion?

Question

I'm looking at the AWS Quickstart for JIRA. It puts the App and DB server into a private subnet but doesn't include a bastion instance. The confluence template does use a bastion instance which makes it possible to connect to the app server through the bastion.

How am I supposed to connect to the Jira app ec2 instance without a bastion server? Am I missing something?

Cheers

edit: My personal opinion... To other potential AWS / Atlassian users... I would not consider the templates production ready without modification. There are obvious things like missing bastions and other silly things. The core mechanisms work and the apps start but look out for things like a 3600s load balancer timeout on the Jira Loadbalancer and other fun things to mess with the setup.

The templates should be considered mostly as inspiration to make them your own.

Sebastian Kouba · Answer

Hi Steffen,

thanks for providing so much information and links! We're also making a bunch of changes in a similar direction. We're trying to stay close to the official recommendations so we can rely on official support but as you have also noticed there is room for improvement with the official cloud formation files.

Hopefully I'll have time to compare notes with what you guys are doing and maybe contribute.

Either way thanks for posting since it will probably be useful for others as well.

Unfortunately I haven't received any emails from Steve thus far.

Steffen Opel [Utoolity] · Answer

Hi Sebastian,

We (Utoolity) are currently improving the public AWS Quick Starts for Atlassian products for our own needs, with a primary focus on cost reduction for development scenarios, and a secondary focus on UX/DX in terms of consistency across all products (many differences seem to be arbitrary indeed).

We have made resp. changes across the board, for example the option to use a shared bastion host within a shared VPC, which implies enabling a bastion host for Jira in the first place (see pull request #5). We have also added options to use EC2 spot instances and a free ACM SSL certificate, plus a few other changes (see the merged pull requests for details).

You can find our ongoing work in the 'utoolity' branches in the Utoolity AWS Quick Starts (Labs) project on Bitbucket (also mirrored to GitHub):

* quickstart-linux-bastion
* quickstart-atlassian-bitbucket
* quickstart-atlassian-confluence
* quickstart-atlassian-jira

While we hope to merge some of our changes into Atlassian's actively worked upon upstream versions at https://bitbucket.org/atlassian/atlassian-aws-deployment/ down the road, those are too much in flux currently to make this viable, which is why we have been basing our changes on the older published versions maintained within the https://github.com/aws-quickstart/ organization instead (thus requiring some overlapping changes, e.g. instance type updates).

I hope it goes without saying that these changes are work in progress, unsupported, and unfortunately also undocumented right now due to lack of time for a summarizing blog post or so. In other words, you probably need to consult the commit history to infer details about a particular difference to the official version, and referencing our forks here is not a commitment to quality of life improvements of any kind ;)

steve_2t0f35 · Answer

Thanks for the feedback on this.

Firstly, you are correct there is no bastion host on AWS. In order to connect to the individual nodes to administer, or control them you have a few options:

* Add an internet gateway/modify the routing table to allow the hosts to connect (not recommended).
* Use the AWS VPN to connect to your VPC.
* Build a bastion host.

We are constantly looking for ways to improve our AWS offerings and so I've marked this as a feature request, https://jira.atlassian.com/browse/JRASERVER-67550

RE: Your other notes, I'm happy to have a chat, I'll send you an email to kick off the conversation.

Steve.