-
Notifications
You must be signed in to change notification settings - Fork 34
/
security-groups.yaml
121 lines (106 loc) · 4.39 KB
/
security-groups.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
Description: >
This template contains the security groups required by our entire stack.
We create them in a seperate nested template, so they can be referenced
by all of the other nested templates.
Parameters:
EnvironmentName:
Description: An environment name that will be prefixed to resource names
Type: String
VPC:
Type: AWS::EC2::VPC::Id
Description: Choose which VPC the security groups should be deployed to
Resources:
# This security group defines who/where is allowed to access the ECS hosts directly.
# By default we're just allowing access from the load balancer. If you want to SSH
# into the hosts, or expose non-load balanced services you can open their ports here.
ECSHostSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
GroupDescription: Access to the ECS hosts and the tasks/containers that run on them
SecurityGroupIngress:
- SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
IpProtocol: '-1'
- SourceSecurityGroupId: !Ref BastionHostSecurityGroup
IpProtocol: tcp
FromPort: 22
ToPort: 22
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-ECS-Hosts
# This security group defines who/where is allowed to access the Application Load Balancer.
# By default, we've opened this up to the public internet (0.0.0.0/0) but can you restrict
# it further if you want.
LoadBalancerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
GroupDescription: Access to the load balancer that sits in front of ECS
SecurityGroupIngress:
# Allow access from the LC network to our ECS services
- CidrIp: 140.147.0.0/16
IpProtocol: tcp
FromPort: 80
ToPort: 80
- CidrIp: 140.147.0.0/16
IpProtocol: tcp
FromPort: 443
ToPort: 443
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-LoadBalancers
- Key: AllowCloudFlareIngress
Value: 'true'
DatabaseSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
GroupDescription: Access to the RDS Postgres database
SecurityGroupIngress:
- SourceSecurityGroupId: !Ref ECSHostSecurityGroup
IpProtocol: tcp
FromPort: 5432
ToPort: 5432
BastionHostSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
GroupDescription: Bastion hosts for ECS access
SecurityGroupIngress:
- CidrIp: 140.147.0.0/16
IpProtocol: tcp
FromPort: 22
ToPort: 22
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-BastionHosts
CacheServiceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
GroupDescription: Access to cache services for ECS hosts
SecurityGroupIngress:
- SourceSecurityGroupId: !Ref 'ECSHostSecurityGroup'
IpProtocol: tcp
FromPort: 6379
ToPort: 6379
- SourceSecurityGroupId: !Ref 'ECSHostSecurityGroup'
IpProtocol: tcp
FromPort: 11211
ToPort: 11211
Outputs:
ECSHostSecurityGroup:
Description: A reference to the security group for ECS hosts
Value: !Ref ECSHostSecurityGroup
LoadBalancerSecurityGroup:
Description: A reference to the security group for load balancers
Value: !Ref LoadBalancerSecurityGroup
DatabaseSecurityGroup:
Description: A reference to the security group for RDS
Value: !Ref DatabaseSecurityGroup
BastionHostSecurityGroup:
Description: A reference to the security group for bastion hosts
Value: !Ref BastionHostSecurityGroup
CacheServiceSecurityGroup:
Description: A reference to the security group for cache services
Value: !Ref CacheServiceSecurityGroup