Can a bastion be assigned a specific AWS Elastic IP with Terraform?

Question

We need to whitelist some Elastic IPs from the corporate firewall as allowed destination IPs for SSH. Is there a way to configure a bastion instance with Terraform and assign it a specific Elastic IP? And, likewise, have it return that EIP to the provisioned pool when the bastion is destroyed? Obviously, we don't want EIPs to be deallocated from our AWS account.

Answer 1

Existing answer is outdated. Associating existing Elastic IPs is now possible thanks to this change: https://github.com/hashicorp/terraform/pull/5236

Docs: https://www.terraform.io/docs/providers/aws/r/eip_association.html

Excerpt:

aws_eip_association

Provides an AWS EIP Association as a top level resource, to associate and disassociate Elastic IPs from AWS Instances and Network Interfaces.

NOTE: aws_eip_association is useful in scenarios where EIPs are either pre-existing or distributed to customers or users and therefore cannot be changed.