Options to disable the bastoin SG + optional aws profile config for aws provider

Makefile

@@ -1,3 +1,6 @@
+fmt:
+	@terraform fmt -recursive .
+
 init:
 	@terraform init
 

bastion.tf

@@ -99,19 +99,18 @@ resource "aws_key_pair" "bastion_host" {
 }
 
 resource "aws_security_group" "bastion_host" {
-  count = var.private ? 1 : 0
+  count = var.private && !var.use_sshuttle ? 1 : 0
 
   description = "Security group for Bastion access"
   name        = "${var.cluster_name}-bastion"
   vpc_id      = module.network.vpc_id
 
-  # TODO: we technically should not need this if we are using sshuttle
   ingress {
     description = "Bastion SSH Ingress"
     from_port   = 22
     to_port     = 22
     protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = var.bastion_cidr_blocks
   }
 
   egress {

provider.tf

@@ -21,5 +21,6 @@ provider "rhcs" {
 }
 
 provider "aws" {
-  region = var.region
+  region  = var.region
+  profile = var.aws_profile
 }

variables.tf

@@ -4,6 +4,12 @@ variable "private" {
   default     = false
 }
 
+variable "aws_profile" {
+  description = "The AWS profile to use for provisioning resources."
+  type        = string
+  default     = "default"
+}
+
 variable "bastion_public_ssh_key" {
   description = <<EOF
   Location to an SSH public key file on the local system which is used to provide connectivity to the bastion host
@@ -15,8 +21,20 @@ variable "bastion_public_ssh_key" {
 
 variable "bastion_public_ip" {
   description = "Should the Bastion have a public ip?"
-  type = bool
-  default = false
+  type        = bool
+  default     = false
+}
+
+variable "bastion_cidr_blocks" {
+  description = "CIDR blocks for Bastion SSH Ingress"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "use_sshuttle" {
+  description = "Set to true to use sshuttle and skip creating security group for SSH access."
+  type        = bool
+  default     = true
 }
 
 variable "aws_billing_account_id" {