From fe9734690bc2982b82a55028d45d641cbebc8a2e Mon Sep 17 00:00:00 2001
From: Cameron Stokes <cameron@tailscale.com>
Date: Sun, 27 Sep 2026 10:31:37 -0700
Subject: [PATCH 1/4] terraform: make examples more consistent and clean up
 unused things

---
 .../outputs.tf                                | 20 -------------------
 .../outputs.tf                                | 14 -------------
 terraform/aws/aws-ec2-autoscaling/outputs.tf  | 14 -------------
 .../outputs.tf                                | 14 -------------
 .../outputs.tf                                | 14 -------------
 terraform/aws/aws-ec2-instance/outputs.tf     | 14 -------------
 terraform/azure/azure-linux-vm/outputs.tf     | 14 -------------
 .../google/google-compute-instance/outputs.tf |  6 ------
 8 files changed, 110 deletions(-)

diff --git a/terraform/aws/aws-ec2-autoscaling-relay-to-private-subnet/outputs.tf b/terraform/aws/aws-ec2-autoscaling-relay-to-private-subnet/outputs.tf
index 1113229..fb440b9 100644
--- a/terraform/aws/aws-ec2-autoscaling-relay-to-private-subnet/outputs.tf
+++ b/terraform/aws/aws-ec2-autoscaling-relay-to-private-subnet/outputs.tf
@@ -6,14 +6,6 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
-output "vpc_cidr" {
-  value = module.vpc.vpc_cidr_block
-}
-
-output "nat_public_ips" {
-  value = module.vpc.nat_public_ips
-}
-
 output "connector_autoscaling_group_name" {
   value = module.connector.autoscaling_group_name
 }
@@ -21,15 +13,3 @@ output "connector_autoscaling_group_name" {
 output "relay_autoscaling_group_name" {
   value = module.relay.autoscaling_group_name
 }
-
-output "connector_user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.connector.user_data_md5
-  sensitive   = true
-}
-
-output "relay_user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.relay.user_data_md5
-  sensitive   = true
-}
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf
index 6344142..ab78235 100644
--- a/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf
+++ b/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf
@@ -6,20 +6,6 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
-output "vpc_cidr" {
-  value = module.vpc.vpc_cidr_block
-}
-
-output "nat_public_ips" {
-  value = module.vpc.nat_public_ips
-}
-
 output "autoscaling_group_name" {
   value = module.tailscale_aws_ec2_autoscaling.autoscaling_group_name
 }
-
-output "user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.tailscale_aws_ec2_autoscaling.user_data_md5
-  sensitive   = true
-}
diff --git a/terraform/aws/aws-ec2-autoscaling/outputs.tf b/terraform/aws/aws-ec2-autoscaling/outputs.tf
index 6344142..ab78235 100644
--- a/terraform/aws/aws-ec2-autoscaling/outputs.tf
+++ b/terraform/aws/aws-ec2-autoscaling/outputs.tf
@@ -6,20 +6,6 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
-output "vpc_cidr" {
-  value = module.vpc.vpc_cidr_block
-}
-
-output "nat_public_ips" {
-  value = module.vpc.nat_public_ips
-}
-
 output "autoscaling_group_name" {
   value = module.tailscale_aws_ec2_autoscaling.autoscaling_group_name
 }
-
-output "user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.tailscale_aws_ec2_autoscaling.user_data_md5
-  sensitive   = true
-}
diff --git a/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/outputs.tf b/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/outputs.tf
index 739e305..2e1919b 100644
--- a/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/outputs.tf
+++ b/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/outputs.tf
@@ -6,20 +6,6 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
-output "vpc_cidr" {
-  value = module.vpc.vpc_cidr_block
-}
-
-output "nat_public_ips" {
-  value = module.vpc.nat_public_ips
-}
-
 output "instance_ids" {
   value = module.tailscale_aws_ec2[*].instance_id
 }
-
-output "user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.tailscale_aws_ec2.user_data_md5
-  sensitive   = true
-}
diff --git a/terraform/aws/aws-ec2-instance-windows-server/outputs.tf b/terraform/aws/aws-ec2-instance-windows-server/outputs.tf
index cafdee3..9f1c6d6 100644
--- a/terraform/aws/aws-ec2-instance-windows-server/outputs.tf
+++ b/terraform/aws/aws-ec2-instance-windows-server/outputs.tf
@@ -6,20 +6,6 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
-output "vpc_cidr" {
-  value = module.vpc.vpc_cidr_block
-}
-
-output "nat_public_ips" {
-  value = module.vpc.nat_public_ips
-}
-
 output "instance_ids" {
   value = module.tailscale_aws_ec2_windows[*].instance_id
 }
-
-output "user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.tailscale_aws_ec2_windows.user_data_md5
-  sensitive   = true
-}
diff --git a/terraform/aws/aws-ec2-instance/outputs.tf b/terraform/aws/aws-ec2-instance/outputs.tf
index 739e305..2e1919b 100644
--- a/terraform/aws/aws-ec2-instance/outputs.tf
+++ b/terraform/aws/aws-ec2-instance/outputs.tf
@@ -6,20 +6,6 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
-output "vpc_cidr" {
-  value = module.vpc.vpc_cidr_block
-}
-
-output "nat_public_ips" {
-  value = module.vpc.nat_public_ips
-}
-
 output "instance_ids" {
   value = module.tailscale_aws_ec2[*].instance_id
 }
-
-output "user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.tailscale_aws_ec2.user_data_md5
-  sensitive   = true
-}
diff --git a/terraform/azure/azure-linux-vm/outputs.tf b/terraform/azure/azure-linux-vm/outputs.tf
index 97ad700..024160c 100644
--- a/terraform/azure/azure-linux-vm/outputs.tf
+++ b/terraform/azure/azure-linux-vm/outputs.tf
@@ -6,14 +6,6 @@ output "vpc_id" {
   value = module.vpc.vnet_id
 }
 
-output "vpc_cidrs" {
-  value = module.vpc.vnet_address_space
-}
-
-output "nat_public_ips" {
-  value = module.vpc.nat_public_ips
-}
-
 output "public_subnet_id" {
   value = module.vpc.public_subnet_id
 }
@@ -36,9 +28,3 @@ output "ssh_private_key_openssh" {
   value     = var.admin_public_key_path == "" ? tls_private_key.ssh[0].private_key_openssh : null
   sensitive = true
 }
-
-output "user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.tailscale_azure_linux_virtual_machine.user_data_md5
-  sensitive   = true
-}
diff --git a/terraform/google/google-compute-instance/outputs.tf b/terraform/google/google-compute-instance/outputs.tf
index 63d0d0c..79698de 100644
--- a/terraform/google/google-compute-instance/outputs.tf
+++ b/terraform/google/google-compute-instance/outputs.tf
@@ -9,9 +9,3 @@ output "instance_id" {
 output "subnets_ips" {
   value = module.vpc.subnets_ips
 }
-
-output "user_data_md5" {
-  description = "MD5 hash of the VM user_data script - for detecting changes"
-  value       = module.tailscale_instance.user_data_md5
-  sensitive   = true
-}

From 1a013633dcda816b1a5de2c1b40f2a14fa3a3046 Mon Sep 17 00:00:00 2001
From: Cameron Stokes <cameron@tailscale.com>
Date: Sun, 27 Sep 2026 11:01:01 -0700
Subject: [PATCH 2/4] bunch of renames

---
 .../aws/aws-ec2-autoscaling-session-recorder/main.tf |  2 +-
 ...der_docker.tftpl => tsrecorder-docker.bash.tftpl} |  0
 .../aws-ec2-instance-windows-server/main.tf          |  2 +-
 ...windows.ps1.tftpl => tailscale-install.ps1.tftpl} |  0
 terraform/azure/azure-linux-vm/main.tf               |  6 +++---
 .../azure/internal-modules/azure-network/main.tf     | 12 ++++++------
 .../internal-modules/azure-network/variables.tf      |  6 +++---
 .../tailscale-advertise-routes/aws.tf                |  2 +-
 .../tailscale-advertise-routes/main.tf               |  2 +-
 ...tise-routes.tftpl => advertise-routes.bash.tftpl} |  0
 ...et-routes-aws.tftpl => get-routes-aws.bash.tftpl} |  0
 .../tailscale-install-scripts/main.tf                |  2 +-
 ...ale-ubuntu.tftpl => tailscale-install.bash.tftpl} |  0
 13 files changed, 17 insertions(+), 17 deletions(-)
 rename terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/{tsrecorder_docker.tftpl => tsrecorder-docker.bash.tftpl} (100%)
 rename terraform/aws/internal-modules/aws-ec2-instance-windows-server/scripts/{tailscale-windows.ps1.tftpl => tailscale-install.ps1.tftpl} (100%)
 rename terraform/internal-modules/tailscale-advertise-routes/scripts/{advertise-routes.tftpl => advertise-routes.bash.tftpl} (100%)
 rename terraform/internal-modules/tailscale-advertise-routes/scripts/{get-routes-aws.tftpl => get-routes-aws.bash.tftpl} (100%)
 rename terraform/internal-modules/tailscale-install-scripts/scripts/{tailscale-ubuntu.tftpl => tailscale-install.bash.tftpl} (100%)

diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
index 8f12ab8..a71fec4 100644
--- a/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
+++ b/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
@@ -161,7 +161,7 @@ module "tailscale_aws_ec2_autoscaling" {
   #
   additional_after_scripts = [
     templatefile(
-      "${path.module}/scripts/tsrecorder_docker.tftpl",
+      "${path.module}/scripts/tsrecorder-docker.bash.tftpl",
       {
         tailscale_recorder_auth_key = tailscale_tailnet_key.recorder.key,
         aws_access_key              = aws_iam_access_key.recorder.id,
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder_docker.tftpl b/terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder-docker.bash.tftpl
similarity index 100%
rename from terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder_docker.tftpl
rename to terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder-docker.bash.tftpl
diff --git a/terraform/aws/internal-modules/aws-ec2-instance-windows-server/main.tf b/terraform/aws/internal-modules/aws-ec2-instance-windows-server/main.tf
index e7feaee..29a7764 100644
--- a/terraform/aws/internal-modules/aws-ec2-instance-windows-server/main.tf
+++ b/terraform/aws/internal-modules/aws-ec2-instance-windows-server/main.tf
@@ -5,7 +5,7 @@ locals {
   windows_admin_password_ssm_parameter_name = "/${var.tailscale_hostname}/windows-admin-password"
 
   windows_install_script = templatefile(
-    "${path.module}/scripts/tailscale-windows.ps1.tftpl",
+    "${path.module}/scripts/tailscale-install.ps1.tftpl",
     {
       auth_key_ssm_parameter_name = local.tailscale_auth_key_ssm_parameter_name,
       tailscale_hostname          = var.tailscale_hostname,
diff --git a/terraform/aws/internal-modules/aws-ec2-instance-windows-server/scripts/tailscale-windows.ps1.tftpl b/terraform/aws/internal-modules/aws-ec2-instance-windows-server/scripts/tailscale-install.ps1.tftpl
similarity index 100%
rename from terraform/aws/internal-modules/aws-ec2-instance-windows-server/scripts/tailscale-windows.ps1.tftpl
rename to terraform/aws/internal-modules/aws-ec2-instance-windows-server/scripts/tailscale-install.ps1.tftpl
diff --git a/terraform/azure/azure-linux-vm/main.tf b/terraform/azure/azure-linux-vm/main.tf
index a35b44f..5586916 100644
--- a/terraform/azure/azure-linux-vm/main.tf
+++ b/terraform/azure/azure-linux-vm/main.tf
@@ -48,9 +48,9 @@ module "vpc" {
   resource_group_id   = local.resource_group_id
   resource_group_name = local.resource_group_name
 
-  subnet_name_public               = "public"
-  subnet_name_private              = "private"
-  subnet_name_private_dns_resolver = "dns-inbound"
+  public_subnet_name               = "public"
+  private_subnet_name              = "private"
+  private_dns_resolver_subnet_name = "dns-inbound"
 }
 
 resource "tls_private_key" "ssh" {
diff --git a/terraform/azure/internal-modules/azure-network/main.tf b/terraform/azure/internal-modules/azure-network/main.tf
index ddd5eca..72ef8d7 100644
--- a/terraform/azure/internal-modules/azure-network/main.tf
+++ b/terraform/azure/internal-modules/azure-network/main.tf
@@ -25,18 +25,18 @@ module "vpc" {
   address_space = local.cidrs
   subnets = {
     "public" = {
-      name             = var.subnet_name_public
+      name             = var.public_subnet_name
       address_prefixes = [local.subnet_cidrs[0]]
     }
     "private" = {
-      name             = var.subnet_name_private
+      name             = var.private_subnet_name
       address_prefixes = [local.subnet_cidrs[1]]
       nat_gateway = {
         id = azurerm_nat_gateway.nat.id
       }
     }
     "dns-inbound" = {
-      name             = var.subnet_name_private_dns_resolver
+      name             = var.private_dns_resolver_subnet_name
       address_prefixes = [local.subnet_cidrs[2]]
       delegations = [{
         name = "Microsoft.Network/dnsResolvers"
@@ -55,7 +55,7 @@ data "azurerm_subnet" "public" {
   resource_group_name = var.resource_group_name
 
   virtual_network_name = module.vpc.name
-  name                 = var.subnet_name_public
+  name                 = var.public_subnet_name
 
   depends_on = [module.vpc.vnet_subnets]
 }
@@ -64,7 +64,7 @@ data "azurerm_subnet" "private" {
   resource_group_name = var.resource_group_name
 
   virtual_network_name = module.vpc.name
-  name                 = var.subnet_name_private
+  name                 = var.private_subnet_name
 
   depends_on = [module.vpc.vnet_subnets]
 }
@@ -73,7 +73,7 @@ data "azurerm_subnet" "dns-inbound" {
   resource_group_name = var.resource_group_name
 
   virtual_network_name = module.vpc.name
-  name                 = var.subnet_name_private_dns_resolver
+  name                 = var.private_dns_resolver_subnet_name
 
   depends_on = [module.vpc.vnet_subnets]
 }
diff --git a/terraform/azure/internal-modules/azure-network/variables.tf b/terraform/azure/internal-modules/azure-network/variables.tf
index 8281b1f..8e4bca0 100644
--- a/terraform/azure/internal-modules/azure-network/variables.tf
+++ b/terraform/azure/internal-modules/azure-network/variables.tf
@@ -35,15 +35,15 @@ variable "subnet_cidrs" {
   type        = list(string)
   default     = []
 }
-variable "subnet_name_public" {
+variable "public_subnet_name" {
   description = "Name of the `public` subnet"
   type        = string
 }
-variable "subnet_name_private" {
+variable "private_subnet_name" {
   description = "Name of the `private` subnet"
   type        = string
 }
-variable "subnet_name_private_dns_resolver" {
+variable "private_dns_resolver_subnet_name" {
   description = "Name of the `dns resolver` subnet"
   type        = string
 }
diff --git a/terraform/internal-modules/tailscale-advertise-routes/aws.tf b/terraform/internal-modules/tailscale-advertise-routes/aws.tf
index 61a1a01..2a57269 100644
--- a/terraform/internal-modules/tailscale-advertise-routes/aws.tf
+++ b/terraform/internal-modules/tailscale-advertise-routes/aws.tf
@@ -6,7 +6,7 @@ variable "tailscale_advertise_aws_service_names" {
 
 locals {
   aws_routes_script = length(var.tailscale_advertise_aws_service_names) == 0 ? null : templatefile(
-    "${path.module}/scripts/get-routes-aws.tftpl",
+    "${path.module}/scripts/get-routes-aws.bash.tftpl",
     {
       tailscale_advertise_aws_service_names = var.tailscale_advertise_aws_service_names,
       routes_file_to_append                 = var.tailscale_advertise_routes_from_file_on_host,
diff --git a/terraform/internal-modules/tailscale-advertise-routes/main.tf b/terraform/internal-modules/tailscale-advertise-routes/main.tf
index 1c68b65..02b5d9c 100644
--- a/terraform/internal-modules/tailscale-advertise-routes/main.tf
+++ b/terraform/internal-modules/tailscale-advertise-routes/main.tf
@@ -11,7 +11,7 @@ locals {
   ) == 0
 
   advertise_routes_script = local.routes_to_advertise ? "" : templatefile(
-    "${path.module}/scripts/advertise-routes.tftpl",
+    "${path.module}/scripts/advertise-routes.bash.tftpl",
     {
       tailscale_advertise_routes                   = join(",", var.tailscale_advertise_routes),
       tailscale_advertise_routes_from_file_on_host = local.saas_routes_to_advertise ? "" : var.tailscale_advertise_routes_from_file_on_host
diff --git a/terraform/internal-modules/tailscale-advertise-routes/scripts/advertise-routes.tftpl b/terraform/internal-modules/tailscale-advertise-routes/scripts/advertise-routes.bash.tftpl
similarity index 100%
rename from terraform/internal-modules/tailscale-advertise-routes/scripts/advertise-routes.tftpl
rename to terraform/internal-modules/tailscale-advertise-routes/scripts/advertise-routes.bash.tftpl
diff --git a/terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.tftpl b/terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.bash.tftpl
similarity index 100%
rename from terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.tftpl
rename to terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.bash.tftpl
diff --git a/terraform/internal-modules/tailscale-install-scripts/main.tf b/terraform/internal-modules/tailscale-install-scripts/main.tf
index b87cd0d..b6b838b 100644
--- a/terraform/internal-modules/tailscale-install-scripts/main.tf
+++ b/terraform/internal-modules/tailscale-install-scripts/main.tf
@@ -1,6 +1,6 @@
 locals {
   ubuntu_install_script = templatefile(
-    "${path.module}/scripts/tailscale-ubuntu.tftpl",
+    "${path.module}/scripts/tailscale-install.bash.tftpl",
     {
       tailscale_auth_key        = var.tailscale_auth_key,
       tailscale_arguments       = local.tailscale_arguments,
diff --git a/terraform/internal-modules/tailscale-install-scripts/scripts/tailscale-ubuntu.tftpl b/terraform/internal-modules/tailscale-install-scripts/scripts/tailscale-install.bash.tftpl
similarity index 100%
rename from terraform/internal-modules/tailscale-install-scripts/scripts/tailscale-ubuntu.tftpl
rename to terraform/internal-modules/tailscale-install-scripts/scripts/tailscale-install.bash.tftpl

From 55cc2195ec85ef7a5e0e454329922dd2e519e599 Mon Sep 17 00:00:00 2001
From: Cameron Stokes <cameron@tailscale.com>
Date: Sun, 27 Sep 2026 11:04:50 -0700
Subject: [PATCH 3/4] remove aws-ec2-autoscaling-session-recorder

---
 .../README.md                                 |  28 ---
 .../main.tf                                   | 212 ------------------
 .../outputs.tf                                |  11 -
 .../scripts/tsrecorder-docker.bash.tftpl      |  38 ----
 .../versions.tf                               |  14 --
 5 files changed, 303 deletions(-)
 delete mode 100644 terraform/aws/aws-ec2-autoscaling-session-recorder/README.md
 delete mode 100644 terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
 delete mode 100644 terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf
 delete mode 100644 terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder-docker.bash.tftpl
 delete mode 100644 terraform/aws/aws-ec2-autoscaling-session-recorder/versions.tf

diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/README.md b/terraform/aws/aws-ec2-autoscaling-session-recorder/README.md
deleted file mode 100644
index 1c6ba93..0000000
--- a/terraform/aws/aws-ec2-autoscaling-session-recorder/README.md
+++ /dev/null
@@ -1,28 +0,0 @@
-# aws-ec2-autoscaling-session-recorder
-
-This example creates the following:
-
-- a VPC and related resources including a NAT Gateway
-- an EC2 Launch Template and a userdata script to install and configure Tailscale and a [Tailscale SSH session recording container](https://tailscale.com/kb/1246/tailscale-ssh-session-recording)
-- an EC2 Autoscaling Group (ASG) using the Launch Template with `min_size`, `max_size`, and `desired_capacity` set to `1`
-- a Tailnet device key to authenticate instances launched by the ASG to your Tailnet
-
-## To use
-
-Follow the documentation to configure the Terraform providers:
-
-- [Tailscale](https://registry.terraform.io/providers/tailscale/tailscale/latest/docs)
-- [AWS](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
-
-### Deploy
-
-```shell
-terraform init
-terraform apply
-```
-
-## To destroy
-
-```shell
-terraform destroy
-```
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
deleted file mode 100644
index a71fec4..0000000
--- a/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
+++ /dev/null
@@ -1,212 +0,0 @@
-locals {
-  name = "example-${basename(path.cwd)}"
-
-  aws_tags = {
-    Name = local.name
-  }
-
-  tailscale_acl_tags = [
-    "tag:example-infra",
-  ]
-  tailscale_set_preferences = [
-    "--auto-update",
-    "--ssh",
-  ]
-
-  # Modify these to use your own VPC
-  vpc_cidr_block     = module.vpc.vpc_cidr_block
-  vpc_id             = module.vpc.vpc_id
-  subnet_id          = module.vpc.private_subnets[0]
-  security_group_ids = [aws_security_group.tailscale.id]
-  instance_type      = "c7g.medium"
-  vpc_endpoint_route_table_ids = flatten([
-    module.vpc.public_route_table_ids,
-    module.vpc.private_route_table_ids,
-  ])
-}
-
-# Remove this to use your own VPC.
-module "vpc" {
-  source = "../internal-modules/aws-vpc"
-
-  name = local.name
-  tags = local.aws_tags
-}
-
-resource "aws_vpc_endpoint" "recorder" {
-  vpc_id          = local.vpc_id
-  service_name    = "com.amazonaws.${aws_s3_bucket.recorder.region}.s3"
-  route_table_ids = local.vpc_endpoint_route_table_ids
-  tags            = local.aws_tags
-}
-
-resource "aws_s3_bucket" "recorder" {
-  bucket_prefix = substr(local.name, 0, 37)
-  tags          = local.aws_tags
-
-  force_destroy = true
-}
-
-resource "aws_s3_bucket_ownership_controls" "recorder" {
-  bucket = aws_s3_bucket.recorder.id
-
-  rule {
-    object_ownership = "BucketOwnerEnforced"
-  }
-}
-
-resource "aws_s3_bucket_policy" "recorder" {
-  bucket = aws_s3_bucket.recorder.id
-  policy = <<-EOT
-  {
-    "Version": "2012-10-17",
-    "Statement": [
-      {
-        "Sid": "Allow-access-from-specific-VPCE",
-        "Effect": "Deny",
-        "Principal": "*",
-        "Action": [
-          "s3:PutObject",
-          "s3:GetObject"
-        ],
-        "Resource": [
-          "${aws_s3_bucket.recorder.arn}",
-          "${aws_s3_bucket.recorder.arn}/*"
-        ],
-        "Condition": {
-          "StringNotEquals": {
-            "aws:sourceVpce": "${aws_vpc_endpoint.recorder.id}"
-          }
-        }
-      }
-    ]
-  }
-  EOT
-}
-
-resource "aws_iam_policy" "recorder" {
-  tags   = local.aws_tags
-  policy = <<-EOT
-  {
-    "Version": "2012-10-17",
-    "Statement": [
-      {
-        "Effect": "Allow",
-        "Action": [
-          "s3:PutObject",
-          "s3:GetBucketLocation",
-          "s3:GetObject",
-          "s3:ListBucket"
-        ],
-        "Resource": [
-          "${aws_s3_bucket.recorder.arn}",
-          "${aws_s3_bucket.recorder.arn}/*"
-        ]
-      }
-    ]
-  }
-  EOT
-}
-
-resource "aws_iam_user" "recorder" {
-  name = local.name
-  tags = local.aws_tags
-}
-
-resource "aws_iam_policy_attachment" "recorder" {
-  name       = local.name
-  policy_arn = aws_iam_policy.recorder.arn
-  users      = [aws_iam_user.recorder.name]
-}
-
-resource "aws_iam_access_key" "recorder" {
-  user = aws_iam_user.recorder.name
-}
-
-resource "tailscale_tailnet_key" "recorder" {
-  ephemeral           = true
-  preauthorized       = true
-  reusable            = true
-  recreate_if_invalid = "always"
-  tags = [
-    "tag:example-sessionrecorder",
-  ]
-}
-
-resource "tailscale_tailnet_key" "main" {
-  ephemeral           = true
-  preauthorized       = true
-  reusable            = true
-  recreate_if_invalid = "always"
-  tags                = local.tailscale_acl_tags
-}
-
-module "tailscale_aws_ec2_autoscaling" {
-  source = "../internal-modules/aws-ec2-autoscaling/"
-
-  autoscaling_group_name = local.name
-  instance_type          = local.instance_type
-  instance_tags          = local.aws_tags
-
-  subnet_id          = local.subnet_id
-  security_group_ids = local.security_group_ids
-
-  # Variables for Tailscale resources
-  tailscale_hostname        = local.name
-  tailscale_auth_key        = tailscale_tailnet_key.main.key
-  tailscale_set_preferences = local.tailscale_set_preferences
-
-  #
-  # Set up Tailscale Session Recorder (tsrecorder)
-  #
-  additional_after_scripts = [
-    templatefile(
-      "${path.module}/scripts/tsrecorder-docker.bash.tftpl",
-      {
-        tailscale_recorder_auth_key = tailscale_tailnet_key.recorder.key,
-        aws_access_key              = aws_iam_access_key.recorder.id,
-        aws_secret_access_key       = aws_iam_access_key.recorder.secret,
-        bucket_name                 = aws_s3_bucket.recorder.bucket,
-        bucket_region               = aws_s3_bucket.recorder.region,
-      }
-    )
-  ]
-
-  depends_on = [
-    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
-  ]
-}
-
-resource "aws_security_group" "tailscale" {
-  vpc_id = local.vpc_id
-  name   = local.name
-}
-
-resource "aws_security_group_rule" "tailscale_ingress" {
-  security_group_id = aws_security_group.tailscale.id
-  type              = "ingress"
-  from_port         = 41641
-  to_port           = 41641
-  protocol          = "udp"
-  cidr_blocks       = ["0.0.0.0/0"]
-  ipv6_cidr_blocks  = ["::/0"]
-}
-
-resource "aws_security_group_rule" "egress" {
-  security_group_id = aws_security_group.tailscale.id
-  type              = "egress"
-  from_port         = 0
-  to_port           = 0
-  protocol          = "-1"
-  cidr_blocks       = ["0.0.0.0/0"]
-  ipv6_cidr_blocks  = ["::/0"]
-}
-
-resource "aws_security_group_rule" "internal_vpc_ingress_ipv4" {
-  security_group_id = aws_security_group.tailscale.id
-  type              = "ingress"
-  from_port         = 0
-  to_port           = 0
-  protocol          = "-1"
-  cidr_blocks       = [local.vpc_cidr_block]
-}
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf
deleted file mode 100644
index ab78235..0000000
--- a/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf
+++ /dev/null
@@ -1,11 +0,0 @@
-output "resource_name_prefix" {
-  value = local.name
-}
-
-output "vpc_id" {
-  value = module.vpc.vpc_id
-}
-
-output "autoscaling_group_name" {
-  value = module.tailscale_aws_ec2_autoscaling.autoscaling_group_name
-}
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder-docker.bash.tftpl b/terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder-docker.bash.tftpl
deleted file mode 100644
index 3187413..0000000
--- a/terraform/aws/aws-ec2-autoscaling-session-recorder/scripts/tsrecorder-docker.bash.tftpl
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/bash
-#
-# Installs Docker and run the Session Recorder (tsrecorder) container
-#
-
-echo -e '\n#\n# Tailscale Session Recorder (tsrecorder) installation...\n#\n'
-
-apt-get -yqq install ca-certificates curl gnupg
-
-install -m 0755 -d /etc/apt/keyrings
-curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-chmod a+r /etc/apt/keyrings/docker.gpg
-
-echo \
-"deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
-"$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
-tee /etc/apt/sources.list.d/docker.list > /dev/null
-
-apt-get -qq update
-apt-get -yqq install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-
-mkdir -p "$HOME/tsrecorder/state"
-
-docker run \
-    --rm -d \
-    --name tsrecorder \
-    -e TS_AUTHKEY=${tailscale_recorder_auth_key} \
-    -v $HOME/tsrecorder:/data \
-    tailscale/tsrecorder:stable   \
-    /tsrecorder \
-        --dst='s3://s3.${bucket_region}.amazonaws.com' \
-        --bucket='${bucket_name}' \
-        --access-key=${aws_access_key} \
-        --secret-key=${aws_secret_access_key} \
-        --statedir=/data/state \
-        --ui
-
-echo -e '\n#\n# Complete.\n#\n'
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/versions.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/versions.tf
deleted file mode 100644
index 70d492f..0000000
--- a/terraform/aws/aws-ec2-autoscaling-session-recorder/versions.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = ">= 6.0, < 7.0"
-    }
-    tailscale = {
-      source  = "tailscale/tailscale"
-      version = ">= 0.24"
-    }
-  }
-
-  required_version = ">= 1.0, < 2.0"
-}

From 9d2b61f2e3bbc55f6863a3fa375388b46934070b Mon Sep 17 00:00:00 2001
From: Cameron Stokes <cameron@tailscale.com>
Date: Sun, 27 Sep 2026 11:12:38 -0700
Subject: [PATCH 4/4] remove get-routes-aws.tftpl and related usage

---
 .../tailscale-advertise-routes/README.md      |  3 +-
 .../tailscale-advertise-routes/aws.tf         | 15 ---------
 .../tailscale-advertise-routes/main.tf        | 13 ++------
 .../tailscale-advertise-routes/outputs.tf     |  9 +-----
 .../scripts/get-routes-aws.bash.tftpl         | 31 -------------------
 .../tailscale-advertise-routes/variables.tf   |  4 ---
 6 files changed, 4 insertions(+), 71 deletions(-)
 delete mode 100644 terraform/internal-modules/tailscale-advertise-routes/aws.tf
 delete mode 100644 terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.bash.tftpl

diff --git a/terraform/internal-modules/tailscale-advertise-routes/README.md b/terraform/internal-modules/tailscale-advertise-routes/README.md
index 7e945e9..22c2631 100644
--- a/terraform/internal-modules/tailscale-advertise-routes/README.md
+++ b/terraform/internal-modules/tailscale-advertise-routes/README.md
@@ -8,8 +8,7 @@ Scripts to download, parse, and save various SaaS IP and domain lists to adverti
 module "tailscale-advertise-routes" {
   source = "../../internal-modules/tailscale-advertise-routes"
 
-  tailscale_advertise_aws_service_names = ["GLOBALACCELERATOR"]
-  tailscale_advertise_routes            = [module.vpc.vpc_cidr_block] # ensure initial routes list is re-added
+  tailscale_advertise_routes = [module.vpc.vpc_cidr_block] # ensure initial routes list is re-added
 }
 
 module "tailscale_aws_ec2_autoscaling" {
diff --git a/terraform/internal-modules/tailscale-advertise-routes/aws.tf b/terraform/internal-modules/tailscale-advertise-routes/aws.tf
deleted file mode 100644
index 2a57269..0000000
--- a/terraform/internal-modules/tailscale-advertise-routes/aws.tf
+++ /dev/null
@@ -1,15 +0,0 @@
-variable "tailscale_advertise_aws_service_names" {
-  description = "List of AWS Services to retrieve IP prefixes for - e.g. ['GLOBALACCELERATOR','AMAZON']"
-  type        = set(string)
-  default     = []
-}
-
-locals {
-  aws_routes_script = length(var.tailscale_advertise_aws_service_names) == 0 ? null : templatefile(
-    "${path.module}/scripts/get-routes-aws.bash.tftpl",
-    {
-      tailscale_advertise_aws_service_names = var.tailscale_advertise_aws_service_names,
-      routes_file_to_append                 = var.tailscale_advertise_routes_from_file_on_host,
-    }
-  )
-}
diff --git a/terraform/internal-modules/tailscale-advertise-routes/main.tf b/terraform/internal-modules/tailscale-advertise-routes/main.tf
index 02b5d9c..b261038 100644
--- a/terraform/internal-modules/tailscale-advertise-routes/main.tf
+++ b/terraform/internal-modules/tailscale-advertise-routes/main.tf
@@ -1,20 +1,11 @@
 locals {
-  routes_to_advertise = (
-    # boolean - do we have any routes to advertise?
-    length(var.tailscale_advertise_routes)
-    + length(var.tailscale_advertise_aws_service_names)
-  ) == 0
-
-  saas_routes_to_advertise = (
-    # boolean - do we have any **SaaS** routes to advertise?
-    length(var.tailscale_advertise_aws_service_names)
-  ) == 0
+  routes_to_advertise = length(var.tailscale_advertise_routes) == 0
 
   advertise_routes_script = local.routes_to_advertise ? "" : templatefile(
     "${path.module}/scripts/advertise-routes.bash.tftpl",
     {
       tailscale_advertise_routes                   = join(",", var.tailscale_advertise_routes),
-      tailscale_advertise_routes_from_file_on_host = local.saas_routes_to_advertise ? "" : var.tailscale_advertise_routes_from_file_on_host
+      tailscale_advertise_routes_from_file_on_host = var.tailscale_advertise_routes_from_file_on_host
     }
   )
 }
diff --git a/terraform/internal-modules/tailscale-advertise-routes/outputs.tf b/terraform/internal-modules/tailscale-advertise-routes/outputs.tf
index f3c2979..32eb4d7 100644
--- a/terraform/internal-modules/tailscale-advertise-routes/outputs.tf
+++ b/terraform/internal-modules/tailscale-advertise-routes/outputs.tf
@@ -1,13 +1,6 @@
-/**
- * See other files for vendor-specific variables/outputs - `aws.tf`, etc.
- */
-
 output "routes_script" {
   description = "Sript to fetch, parse, and save routes to `var.routes_file_to_append`"
-  value = join("\n", compact([
-    local.aws_routes_script,
-    local.advertise_routes_script,
-  ]))
+  value       = local.advertise_routes_script
 }
 output "routes_file_to_append" {
   description = "File on the host with (sorted and distinct) routes"
diff --git a/terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.bash.tftpl b/terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.bash.tftpl
deleted file mode 100644
index b5dfe3c..0000000
--- a/terraform/internal-modules/tailscale-advertise-routes/scripts/get-routes-aws.bash.tftpl
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/bash
-#
-# Download and parse a json file from the vendor to create a list of routes to advertise 
-# by Tailscale. The list is saved appended to a file that may have other routes already added.
-# 
-# https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html
-#
-
-echo -e '\n#\n# Beginning AWS routes fetching, parsing, and saving to [${routes_file_to_append}]...\n#\n'
-
-which jq > /dev/null # TODO: move to shared script?
-if [ $? -ne 0 ]; then
-    apt-get -qq update
-    apt-get -yqq install jq
-    echo -e '\n#\n# jq installation complete.\n#\n'
-fi
-
-OUTPUT_FILE_TMP=/tmp/routes-output-aws.txt
-OUTPUT_FILE=${routes_file_to_append}
-
-JSON_FILE=routes-input-aws.json
-curl -s 'https://ip-ranges.amazonaws.com/ip-ranges.json' > $JSON_FILE
-
-%{ for s in tailscale_advertise_aws_service_names ~}
-jq -r '.prefixes[] | select(.service == "${s}").ip_prefix' $JSON_FILE >> $OUTPUT_FILE_TMP
-jq -r '.ipv6_prefixes[] | select(.service == "${s}").ipv6_prefix' $JSON_FILE >> $OUTPUT_FILE_TMP
-%{ endfor ~}
-
-cat $OUTPUT_FILE_TMP | sort | uniq >> $OUTPUT_FILE # append to file to not overwrite routes from other sources
-
-echo -e '\n#\n# Complete.\n#\n'
diff --git a/terraform/internal-modules/tailscale-advertise-routes/variables.tf b/terraform/internal-modules/tailscale-advertise-routes/variables.tf
index 7192178..7273464 100644
--- a/terraform/internal-modules/tailscale-advertise-routes/variables.tf
+++ b/terraform/internal-modules/tailscale-advertise-routes/variables.tf
@@ -1,7 +1,3 @@
-/**
- * See other files for vendor-specific variables/outputs - `aws.tf`, etc.
- */
-
 variable "tailscale_advertise_routes_from_file_on_host" {
   description = "File on the host to append (sorted and distinct) routes to"
   type        = string