Allow customizing the `EnvironmentSecurityGroup` with the environment manifest

[efekarakus]

Ask

For compliance users, customers might require customizing the ingress and egress of the EnvironmentSecurityGroup:

copilot-cli/internal/pkg/template/templates/environment/cf.yml

Line 138 in a28a468

EnvironmentSecurityGroup:

For example, folks might want to remove the default egress rule that gets generated by CloudFormation.

Sample manifest

name: test
type: 'Environment'
security_group:
  ingress:
  - <config>
  egress:
  - <config>

[craigjbass]

This would be useful - in particular, to mitigate against supply chain attacks having services running in a public zone, accessible via an ALB but unable to initiate egress (e.g. initiate an outbound TCP connection or send UDP packets).

[paragbhingre]

Hello @craigjbass,
You are right, we can very well stop the outbound connections by setting following rule in your environment manifest.

network:
  vpc:
    security_group:
      egress:
        - ip_protocol: -1
          ports: 0-65536
          cidr: 127.0.0.1/32

Cloudformation suggests setting above mentioned egress rule in order to remove the default egress applied by the cfn and restrict traffic to just the localhost (127.0.0.1/32).

This feature will go out in the next copilot release.

[dannyrandall]

This feature is now released in v1.21.0! https://github.com/aws/copilot-cli/releases/tag/v1.21.0 🎉