launch-bastion
Last updated
Provision and start a bastion. The bastion fronts the network's nginx reverse proxies and is the SSH/SSM entry point to the fleet.
rumi cloud aws launch-bastion \
--profile <profile> \
--network <network> \
--key-pair <keypair> \
[options]--profile
-p
AWS profile to use
Required
--region
-r
AWS region
us-east-1
--network
-n
Name of the network to launch it into
Required
--key-pair
-k
The network key pair
Required
--name
-b
The bastion name (e.g. data, ops); required in a multi-bastion network, omitted in a single-bastion network
none
--jump-capable
-j
Whether this bastion may SSH/SSM into the fleet (joins the fleet-SSH SG); a proxy-only bastion omits this
false
--instance-profile
-I
The IAM instance profile (name or ARN) to attach; required (granting the SSM managed policy) when the network's access method is ssm-bastion or ssm-all
none
--elastic-ip
-E
Give the bastion a stable Elastic IP (survives stop/start + replacement; reused on re-launch, released at deprovision)
false
In a multi-bastion network (create-network -B), every bastion is named and you must pass --name. In a single-bastion network, omit --name to launch the lone unnamed bastion.
Pass --instance-profile whenever the network uses the ssm-bastion or ssm-all access method. If you intend to run enable-https on this bastion, launch it with -I so it carries an instance profile granting Route53 access.
Last updated
rumi cloud aws launch-bastion \
--profile my-aws-profile \
--network my-network \
--key-pair my-keypair \
--name data \
--jump-capable