feature request: attach an existing security group

[okadakk]

Due to security requirements, we have a security group in place to limit the instances that can access the RDB.
I would like to be able to attach an existing security group.

Thank you!

[iamhopaul123]

Hello @okadakk, this is a very helpful feedback for us! Does it help if Copilot allows importing/configuring a security group on behalf of your service, so as to control the ingress/egress?

[efekarakus]

To add on to @iamhopaul123's comment, what would be an ideal UX for your usecase?

For example, if we add a security_groups field in the manifest would that help for adding additional security groups to your ECS service?

cpu: 256
memory: 512
security_groups: # Additional security groups
  - sg-xxxxxxxx

Is specifying the the security group ID okay with you in the manifest file?

[okadakk]

Thanks @iamhopaul123 @efekarakus !

Does it help if Copilot allows importing/configuring a security group on behalf of your service, so as to control the ingress/egress?

Yes! It helps me a lot.

if we add a security_groups field in the manifest would that help for adding additional security groups to your ECS service?

Sounds good! It's OK specify in the manifest file!

[alex-all3dp]

We would also greatly benefit greatly from such a feature!

@efekarakus Would it then also be possible to define custom security groups as an add-on and reference them in the manifest in order to being assigned to the load balancer?

[iamhopaul123]

Hello @alex-all3dp, why do you want to have security groups defined as addons (like what do you use them for)? Could you provide us more detailed use cases for that? Currently we already have a security group for the ecs service that allows traffic from load balancer and self.

[alex-all3dp]

@iamhopaul123 We would like to be able to modify the default security groups in order to disallow traffic from everywhere but rather restrict inbound traffic to a set of fixed IPs (Cloudflare in our case). Any chance that changing the default security groups would be possible in the near future?

Furthermore our setup would require us to also provide a certificate from ACM to the HTTPS listener on the load balancer.

[efekarakus]

Gotcha! That makes sense, for the first usecase we have this existing issue: #1234, which would be low effort for us to prioritize and deliver. Would that satisfy your requirement?

For the ACM cert and HTTPS listener, did you check out copilot app init --domain Copilot will do all that for you if you provide it with a domain name

[alex-all3dp]

@efekarakus Thank your for your feedback!

Yes, I think the allow-list would satisfy our requirements for that use-case

Thanks for the hint, regarding the --domain flag, I'll give that a try!

[efekarakus]

Heya @alex-all3dp ! The allow-list feature was released in v0.6.0 https://github.com/aws/copilot-cli/releases/tag/v0.6.0 🚀 Hope this helps!