Merge pull request #325 from ministryofjustice/feature/nd174-secrets-…

…accessible-in-plain-text configured vpc endpoint to be always on, previously depended on bastions being enabled
ministryofjustice · May 30, 2024 · f38be34 · f38be34
2 parents 7d79add + 222c626
commit f38be34
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/modules/vpc/endpoints.tf b/modules/vpc/endpoints.tf
@@ -27,10 +27,9 @@ resource "aws_vpc_endpoint" "s3" {
   tags            = var.tags
 }
 
-// endpoints required for session manager
+// enpoint required for bastions and ecs task get ssm parameters
 
 resource "aws_vpc_endpoint" "ssm" {
-  count               = var.ssm_session_manager_endpoints ? 1 : 0
   vpc_id              = module.vpc.vpc_id
   subnet_ids          = module.vpc.public_subnets
   service_name        = "com.amazonaws.${var.region}.ssm"
@@ -41,6 +40,8 @@ resource "aws_vpc_endpoint" "ssm" {
   depends_on          = [aws_security_group.endpoints]
 }
 
+// endpoints required for bastions session manager 
+
 resource "aws_vpc_endpoint" "ssmmessages" {
   count               = var.ssm_session_manager_endpoints ? 1 : 0
   vpc_id              = module.vpc.vpc_id