Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use NAT Gateway Service #213

Merged
merged 5 commits into from
Aug 23, 2023
Merged

Use NAT Gateway Service #213

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f93c2e2
Merge pull request #212 from NASA-IMPACT/develop
anayeaye Aug 15, 2023
73aa15c
use NAT Gateway instead of EC2 Instance as NAT
Aug 23, 2023
a568c03
aws_ec2 mistake
Aug 23, 2023
4e51d31
use aws_ec2.SubnetType.PRIVATE_WITH_EGRESS
Aug 23, 2023
1b55f03
add back in NAT count
Aug 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions standalone_base_infrastructure/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Standalone Base Infrastructure

Optional shared base infrastructure provisioning. This CloudFormation stack is intended to simulate controlled deployment environments. It also useful for deploying a long-standing VPC that can be shared across stacks. This VPC is deployed with an EC2 NAT Instance that is configured as the NAT gateway provider for the private subnets.
Optional shared base infrastructure provisioning. This CloudFormation stack is intended to simulate controlled deployment environments. It also useful for deploying a long-standing VPC that can be shared across stacks. This VPC is deployed with a NAT Gateway Service for the private subnets b/c environments like SMCE require us to manage patches and scale it ourselves which don't want to do. In MCP we can request to use a NAT Gateway Service or use their existing EC2 NAT Instance

## Deployment

Expand All @@ -26,4 +26,3 @@ See main app [deployment instructions](../README.md#deployment).
| `CDK_DEFAULT_REGION` | The AWS region id is required to deploy to an exiting VPC |
| `VPC_CIDR` | The CIDR range to use for the VPC. Default is 10.100.0.0/16 |
| `VPC_MAX_AZS` | Maximum number of availability zones per region. Default is 2. |
| `VPC_NAT_GATEWAYS` | Number of NAT gateways to create. Default is 1. |
31 changes: 3 additions & 28 deletions standalone_base_infrastructure/network_construct.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,9 @@ def __init__(
)
private_subnet = aws_ec2.SubnetConfiguration(
name="private",
subnet_type=aws_ec2.SubnetType.PRIVATE_ISOLATED,
)

nat_provider_instance = aws_ec2.NatProvider.instance(
instance_type=aws_ec2.InstanceType("t3.nano"),
# NOTE: this line automatically creates a NAT Gateway for each AZ
# and binds the route table in the private subnet
subnet_type=aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,
)

vpc = aws_ec2.Vpc(
Expand All @@ -36,26 +34,9 @@ def __init__(
max_azs=base_settings.vpc_max_azs,
cidr=base_settings.vpc_cidr,
subnet_configuration=[public_subnet, private_subnet],
nat_gateway_provider=nat_provider_instance,
nat_gateways=base_settings.vpc_nat_gateways,
)

nat_sg = nat_provider_instance.security_group

# Allow all outbound traffic
nat_sg.add_egress_rule(
aws_ec2.Peer.any_ipv4(),
aws_ec2.Port.all_traffic(),
"Allow all outbound traffic",
)

# Allow inbound traffic from the VPC's CIDR
nat_sg.add_ingress_rule(
aws_ec2.Peer.ipv4(vpc.vpc_cidr_block),
aws_ec2.Port.all_traffic(),
"Allow inbound traffic from the VPCs CIDR block",
)

vpc_endpoints = {
"secretsmanager": aws_ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
"cloudwatch-logs": aws_ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS,
Expand All @@ -69,10 +50,4 @@ def __init__(
elif isinstance(service, aws_ec2.GatewayVpcEndpointAwsService):
vpc.add_gateway_endpoint(id, service=service)

# This config step associates the NAT instance EIP with the private subnet and should happen in VPC construct but does not
for private_subnet in vpc.select_subnets(
subnet_type=aws_ec2.SubnetType.PRIVATE_ISOLATED
).subnets:
nat_provider_instance.configure_subnet(subnet=private_subnet)

CfnOutput(self, "vpc-id", value=vpc.vpc_id)
Loading