title: I can't SSH onto EC2 instance created using Terraform
body: <p>I hope everyone that sees this is doing well.</p>
  <p>I'm still learning the ropes with Terraform and AWS.</p>
  <p>I've created a VPC with 4 subnets in it. 1 subnet is public and the other 3 are private. I currently have 1 EC2 instance in my public subnet (a bastion box/server). I have also created a security group for this instance and have created a NACL rule that allows me to connect via ssh to this instance from my IP only. For some reason when I try to ssh onto this instance my terminal hangs and I see the following message:</p>
  <p>OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f 31 Mar 2020</p>
  <p>debug1: Reading configuration data /etc/ssh/ssh_config</p>
  <p>debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files</p>
  <p>debug1: /etc/ssh/ssh_config line 21: Applying options for *</p>
  <p>debug1: Connecting to 'instance_public_ip [instance_public_ip] port 22</p>
  <p>and then it tells me the connection timed out.</p>
  <p>I changed the rule to allow an ssh connection from all IPs (i.e. 0.0.0.0/0) but still get the same problem. The terraform code for the infrastructure is as follows:</p>
  <pre><code># Elastic IP for bastion server
  resource &quot;aws_eip&quot; &quot;bastion_eip&quot; {
    instance = aws_instance.Bastion.id
    vpc      = true
  }
  
  # EIP association for bastion server
  resource &quot;aws_eip_association&quot; &quot;eip_assoc&quot; {
    instance_id   = aws_instance.Bastion.id
    allocation_id = aws_eip.bastion_eip.id
  }
  
  # Create internet gateway
  resource &quot;aws_internet_gateway&quot; &quot;main-gateway&quot; {
    vpc_id = aws_vpc.main-vpc.id
  
    tags = {
      Name = &quot;main&quot;
    }
  }
  
  # Create route table for public subnet
  resource &quot;aws_route_table&quot; &quot;public-route-table&quot; {
    vpc_id = aws_vpc.main-vpc.id
  
    route {
      cidr_block = &quot;0.0.0.0/0&quot;
      gateway_id = aws_internet_gateway.main-gateway.id
    }
  
    tags = {
      Name = &quot;public-route-table&quot;
    }
  }
  
  # Create subnet 4
  resource &quot;aws_subnet&quot; &quot;subnet-4&quot; {
    vpc_id            = aws_vpc.main-vpc.id
    cidr_block        = &quot;10.0.4.0/24&quot;
    availability_zone = &quot;eu-west-2a&quot;
    tags = {
      Name = &quot;subnet-public&quot;
    }
  }
  
  # Associate subnet 4 with public route table
  resource &quot;aws_route_table_association&quot; &quot;subnet-4&quot; {
    subnet_id      = aws_subnet.subnet-4.id
    route_table_id = aws_route_table.public-route-table.id
  }
  
  # Create bastion server security group (subnet 4)
  resource &quot;aws_security_group&quot; &quot;bastion-sg&quot; {
    name        = &quot;bastion-sg&quot;
    description = &quot;Allow web traffic from specific IPs&quot;
    vpc_id      = aws_vpc.main-vpc.id
  
    # SSH Traffic
    ingress {
      description = &quot;SSH&quot;
      from_port   = 22
      to_port     = 22
      protocol    = &quot;tcp&quot;
      cidr_blocks = [&quot;0.0.0.0/0&quot;] #allow web traffic.
    }
  
    egress {
      from_port   = 22
      to_port     = 22
      protocol    = &quot;tcp&quot;
      cidr_blocks = [&quot;0.0.0.0/0&quot;]
    }
  
    tags = {
      Name = &quot;allow_access_bastion_server&quot;
    }
  }
  
  # Create NACL for public subnet with Prod server &amp; bastion server
  resource &quot;aws_network_acl&quot; &quot;public_nacl&quot; {
    vpc_id     = aws_vpc.main-vpc.id
    subnet_ids = [aws_subnet.subnet-4.id]
  
    # Allow inbound http traffic from internet
    ingress {
      protocol   = &quot;tcp&quot;
      rule_no    = 100
      action     = &quot;allow&quot;
      cidr_block = &quot;0.0.0.0/0&quot;
      from_port  = 80
      to_port    = 80
    }
  
    # Allow outbound http traffic to internet
    egress {
      protocol   = &quot;tcp&quot;
      rule_no    = 100
      action     = &quot;allow&quot;
      cidr_block = &quot;0.0.0.0/0&quot;
      from_port  = 80
      to_port    = 80
    }
  
    # Allow inbound SSH traffic from specific IP
    ingress {
      protocol   = &quot;tcp&quot;
      rule_no    = 103
      action     = &quot;allow&quot;
      cidr_block = &quot;0.0.0.0/0&quot;
      from_port  = 22
      to_port    = 22
    }
  
    # Allow outbound SSH traffic from specific IP
    egress {
      protocol   = &quot;tcp&quot;
      rule_no    = 103
      action     = &quot;allow&quot;
      cidr_block = &quot;0.0.0.0/0&quot;
      from_port  = 22
      to_port    = 22
    }
  
    tags = {
      Name = &quot;public NACL&quot;
    }
  
  }
  
  # Create bastion box 
  resource &quot;aws_instance&quot; &quot;Bastion&quot; {
    ami                    = var.ami-id
    instance_type          = var.instance-type
    key_name               = &quot;aws_key_name&quot;
    vpc_security_group_ids = [&quot;security_group_id&quot;]
    subnet_id              = &quot;subnet_id&quot;
  
    tags = {
      Name = &quot;Bastion Server&quot;
    }
  }
  </code></pre>
  <p>I've been looking at this a while now and can't really see where I've gone wrong. Is the issue with my security group or my IGW or route table? If there's any other information you feel is needed let me know :) and thanks for any help in advance</p>