AWS security harding, allow disabling internet gateway (#141)

* add bastion host source ip restrictions * rename: dev-box->bastion-host * allow disabling internet gateway * misc cleanup
slalom · Oct 8, 2020 · c290261 · c290261
1 parent aaa7358
commit c290261
Show file tree

Hide file tree

Showing 47 changed files with 292 additions and 511 deletions.
diff --git a/catalog/README.md b/catalog/README.md
diff --git a/catalog/aws/bastion-host/main.tf b/catalog/aws/bastion-host/main.tf
@@ -1,16 +1,16 @@
 /*
-* The `dev-box` catalog module deploys an ECS-backed container which can be used to remotely test
-* or develop using the native cloud environment. Applicable use cases include:
+* The `bastion-host` module deploys an ECS-backed container which can be used to remotely test
+* or develop using the native cloud environment.
 *
-* * Debugging network firewall and routing rules
-* * Debugging components which can only be run from whitelisted IP ranges
-* * Offloading heavy processing from the developer's local laptop
-* * Mitigating network relability issues when working from WiFi or home networks
+* Applicable use cases include:
+*
+* - Debugging network firewall and routing rules
+* - Debugging components which can only be run from whitelisted IP ranges
+* - Offloading heavy processing from the developer's local laptop
+* - Mitigating network relability issues when working from WiFi or home networks
 *
 */
 
-data "aws_availability_zones" "az_list" {}
-
 locals {
   name_prefix = "${var.name_prefix}devbox-"
   # container_command = ()
@@ -40,8 +40,9 @@ module "ecs_bastion_task" {
     SSH_PUBLIC_KEY_BASE64 = local.ssh_public_key_base64
   })
   environment_secrets = var.secrets
-  app_ports           = ["22"]
+  app_ports           = []
   admin_ports         = ["22"]
+  admin_cidr          = var.admin_cidr
 }
 
 module "ecr_image" {

diff --git a/catalog/aws/bastion-host/variables.tf b/catalog/aws/bastion-host/variables.tf
@@ -90,3 +90,8 @@ variable "aws_credentials_file" {
   description = "Path to the AWS credentials file, used to ensure that the correct credentials are used during upload of the ECR image."
   type        = string
 }
+variable "admin_cidr" {
+  description = "List of source IP CIDR blocks which should be allowed to connect to the bastion host."
+  type        = list(string)
+  default     = null
+}
diff --git a/catalog/aws/data-lake-users/README.md b/catalog/aws/data-lake-users/README.md
diff --git a/catalog/aws/data-lake/README.md b/catalog/aws/data-lake/README.md
diff --git a/catalog/aws/dbt/README.md b/catalog/aws/dbt/README.md
diff --git a/catalog/aws/dbt/main.tf b/catalog/aws/dbt/main.tf
@@ -4,9 +4,6 @@
 *
 */
 
-data "aws_availability_zones" "az_list" {}
-data "aws_region" "current" {}
-
 locals {
   name_prefix = "${var.name_prefix}DBT-"
   admin_cidr  = var.admin_cidr

diff --git a/catalog/aws/dev-box/README.md b/catalog/aws/dev-box/README.md
diff --git a/catalog/aws/dev-box/main.tf b/catalog/aws/dev-box/main.tf