code: function buildBastionSecurityGroup(sourceIp = '0.0.0.0/0', { name = 'BastionSecurityGroup' } = {}) {
    return {
      [name]: {
        Type: 'AWS::EC2::SecurityGroup',
        Properties: {
          GroupDescription: 'Bastion Host',
          VpcId: {
            Ref: 'VPC',
          },
          SecurityGroupIngress: [
            {
              Description: 'Allow inbound SSH access to the bastion host',
              IpProtocol: 'tcp',
              FromPort: 22,
              ToPort: 22,
              CidrIp: sourceIp,
            },
            {
              Description: 'Allow inbound ICMP to the bastion host',
              IpProtocol: 'icmp',
              FromPort: -1,
              ToPort: -1,
              CidrIp: sourceIp,
            },
          ],
          Tags: [
            {
              Key: 'Name',
              Value: {
                'Fn::Join': [
                  '-',
                  [
                    {
                      Ref: 'AWS::StackName',
                    },
                    'bastion',
                  ],
                ],
              },
            },
          ],
        },
      },
    };
  }
docs: Build a SecurityGroup to be used by the bastion host
  
  @param {String} sourceIp source IP address
  @param {Object} params
  @return {Object}