Skip to content

Remove IP filter from bastion's security group #578

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 1, 2024
Merged

Remove IP filter from bastion's security group #578

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 15 additions & 54 deletions terraform/bastion/firewall.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,41 +1,10 @@
// The resources in this file control who has access to the bastion server.

locals {
// Users allowed to connect to the bastion through SSH. Each user needs to
// have the CIDR of the static IP they want to connect from stored in AWS SSM
// Parameter Store (us-west-1), in a string key named:
//
// /prod/bastion/allowed-ips/${user}
//
allowed_users = [
"aidanhs",
"joshua",
"pietro",
"shep",
"simulacrum",
"technetos",
"nemo157",
"syphar",
"rylev",
"rylev-ip-2",
"jdn",
"guillaumegomez",
"marcoieni",
"ubuntu",
]
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this the list of allowed users now?

simpleinfra/ansible/playbooks/bastion.yml

Line 13 in ca5e95c

unprivileged_users:


// Security group to prevent unauthorized access to the bastion.

data "dns_a_record_set" "monitoring" {
host = "monitoring.infra.rust-lang.org"
}

data "aws_ssm_parameter" "allowed_ips" {
for_each = toset(local.allowed_users)
name = "/prod/bastion/allowed-ips/${each.value}"
}

// Security group to prevent unauthorized access to the bastion.
resource "aws_security_group" "bastion" {
vpc_id = data.terraform_remote_state.shared.outputs.prod_vpc.id
name = "rust-prod-bastion"
Expand All @@ -53,32 +22,24 @@ resource "aws_security_group" "bastion" {
}
}

// SSH access from the allowed users
dynamic "ingress" {
for_each = toset(local.allowed_users)
content {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = [data.aws_ssm_parameter.allowed_ips[ingress.value].value]
description = "SSH access for ${ingress.value}"
}
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]
description = "SSH access from the world"
}

// Ping access from allowed users
dynamic "ingress" {
for_each = toset(local.allowed_users)
content {
from_port = 8
to_port = -1
protocol = "icmp"
cidr_blocks = [data.aws_ssm_parameter.allowed_ips[ingress.value].value]
description = "Ping access for ${ingress.value}"
}
ingress {
from_port = 8
to_port = -1
protocol = "icmp"
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]
description = "Ping access from the world"
}

// Allow outgoing connections

egress {
from_port = 0
to_port = 0
Expand Down
Loading