Prove It Works: A Throwaway Probe Instance

1. 1

   Add the switch

   variable "enable_probe" {
     description = "Create a throwaway instance in a private subnet to test networking."
     type        = bool
     default     = false
   }

2. 2

   Write the probe

   The AMI comes from a filtered, most_recent lookup of Amazon's own Amazon Linux 2023 ARM images, so there's no hardcoded ID that differs per region and goes stale. The role trusts ec2.amazonaws.com and gets the managed SSM policy, which is all Session Manager needs. The probe uses the APP security group, so it tests exactly the paths ShopLite tasks will use.

   data "aws_ami" "al2023_arm" {
     most_recent = true
     owners      = ["amazon"]
   
     filter {
       name   = "name"
       values = ["al2023-ami-2023.*-arm64"]
     }
   }
   
   data "aws_iam_policy_document" "ec2_assume" {
     statement {
       actions = ["sts:AssumeRole"]
       principals {
         type        = "Service"
         identifiers = ["ec2.amazonaws.com"]
       }
     }
   }
   
   resource "aws_iam_role" "probe" {
     count              = var.enable_probe ? 1 : 0
     name               = "${local.name_prefix}-probe"
     assume_role_policy = data.aws_iam_policy_document.ec2_assume.json
   }
   
   resource "aws_iam_role_policy_attachment" "probe_ssm" {
     count      = var.enable_probe ? 1 : 0
     role       = aws_iam_role.probe[0].name
     policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
   }
   
   resource "aws_iam_instance_profile" "probe" {
     count = var.enable_probe ? 1 : 0
     name  = "${local.name_prefix}-probe"
     role  = aws_iam_role.probe[0].name
   }
   
   resource "aws_instance" "probe" {
     count = var.enable_probe ? 1 : 0
   
     ami                    = data.aws_ami.al2023_arm.id
     instance_type          = "t4g.nano"
     subnet_id              = aws_subnet.private[local.azs[0]].id
     vpc_security_group_ids = [aws_security_group.app.id]
     iam_instance_profile   = aws_iam_instance_profile.probe[0].name
   
     metadata_options {
       http_tokens = "required" # IMDSv2 only
     }
   
     tags = { Name = "${local.name_prefix}-probe" }
   }

3. 3

   Output the ID safely

   one() returns null when the probe is disabled instead of erroring.

   output "probe_instance_id" {
     value = one(aws_instance.probe[*].id)
   }

4. 4

   Turn it on

   Make sure NAT is enabled too. The SSM agent needs outbound access to reach the Systems Manager endpoints.

   terminalcopy cmd

   $ terraform apply -var enable_probe=true

   ── expected output ──

   data.aws_ami.al2023_arm: Read complete after 1s [id=ami-0a1b2c3d4e5f67890]

   ...

   Plan: 4 to add, 0 to change, 0 to destroy.

   ...

   aws_instance.probe[0]: Creation complete after 13s [id=i-0123456789abcdef0]

    

   Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

    

   Outputs:

   ...

   probe_instance_id = "i-0123456789abcdef0"

5. 5

   Test both outbound paths from inside

   Give the agent a minute to register, then open a shell. checkip returns the NAT gateway's Elastic IP, which proves the private → NAT → IGW path. Listing the assets bucket goes through the S3 gateway endpoint. It will say AccessDenied, because the probe role has no S3 permissions; getting a response from S3 at all proves the network path, and permissions come in Stage 4.

   terminalcopy cmd

   $ aws ssm start-session --target $(terraform output -raw probe_instance_id)

   # inside the session:

   curl -s https://checkip.amazonaws.com

   aws s3 ls s3://shoplite-dev-assets-3f9a --region ap-south-1

   ── expected output ──

   Starting session with SessionId: priya-0a1b2c3d4e5f

   sh-5.2$ curl -s https://checkip.amazonaws.com

   13.233.41.187

   sh-5.2$ aws s3 ls s3://shoplite-dev-assets-3f9a --region ap-south-1

   An error occurred (AccessDenied) when calling the ListObjectsV2 operation: ...

6. 6

   Turn it off

   Apply with the default (enable_probe = false). All four probe resources go, and the output becomes null. The whole network is now proven and ready for ShopLite's containers.

   terminalcopy cmd

   $ terraform apply

   ── expected output ──

   Plan: 0 to add, 0 to change, 4 to destroy.

    

   Changes to Outputs:

   - probe_instance_id = "i-0123456789abcdef0" -> null

   ...

   Apply complete! Resources: 0 added, 0 changed, 4 destroyed.

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.