Bootstrap: require user to pass Bastion remote access CIDRs

[tjohnes]

Background:

• The Bastion module (responsible for bringing up the Bastion instance) exposes a remote_access_cidr variable. This is a list of CIDRs that are allowed SSH access to the Bastion.
• The default is ["0.0.0.0/0"], which allows access from anywhere.
• This is re-exposed in the Bootstrap module, with the same default.
• So the default behavior for users of the Bootstrap configuration is that a Bastion instance is created that has unrestricted SSH access (other than normal RSA auth)

Modify this so that:

• There is no default value for remote_access_cidr in the Boostrap configuration. This means that users of the Bootstrap configuration must provide a value for this. This is a breaking change.
• This is considered a balance between:
  • More secure than defaulting to 0.0.0.0/0
  • More usable than defaulting to restricting all access - a lot of the point of the Terraform configurations is that users can see how an XRd-capable EC2 node is setup. If no-one can access the Bastion, then no-one can access the nodes.

If the user provides null explicitly, then access to the Bastion is prevented.

The reviewer should consider whether the above is an appropriate balance of i. defaulting to security; ii. usability, both in terms of accessing the Bastion/nodes, and usability of the Terraform configuration given this is a new required variable.

In the aws-quickstart script:

• Add a -b|--bastion-remote-access-cidr-blocks required argument.
• This should be a comma-separated list of CIDRs.
• If the user provides 'null', prevent access to the Bastion.

The implementation of the aws-quickstart script is slightly messy, and an area of focus for the reviewer.