Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch to list of ip cidrs to block #1613

Merged
merged 10 commits into from
Mar 15, 2024
Merged

Switch to list of ip cidrs to block #1613

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
98e836e
Switch to list of ip ranges to block
cweibel Mar 14, 2024
beaa794
Switch to list of ip ranges to block
cweibel Mar 14, 2024
bcaf5aa
Switch to list of ip ranges to block
cweibel Mar 14, 2024
79bb3b6
Switch to list of ip ranges to block
cweibel Mar 14, 2024
bfe3c90
Switch to list of ip ranges to block
cweibel Mar 14, 2024
ab92286
Switch to list of ip ranges to block
cweibel Mar 15, 2024
452aa1b
Merge branch 'main' into cidr_blocks
cweibel Mar 15, 2024
17ac408
Remove default ranges
cweibel Mar 15, 2024
b10c76a
terraform fmt fix
cweibel Mar 15, 2024
ccacc7b
Adding new cidr_blocks to staging and prod
cweibel Mar 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ci/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -523,7 +523,7 @@ jobs:
TF_VAR_customer_whitelist_source_ip_ranges_set_arn: ((customer_whitelist_source_ip_ranges_set_arn))
TF_VAR_internal_vpc_cidrs_set_arn: ((internal_vpc_cidrs_set_arn))
TF_VAR_cg_egress_ip_set_arn: ((cg_egress_ip_set_arn))
TF_VAR_block_range_20: ((block_range_20))
TF_VAR_cidr_blocks: ((cidr_blocks))
- *notify-slack

- name: bootstrap-development
Expand Down
8 changes: 5 additions & 3 deletions terraform/modules/bosh_vpc/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,8 @@ variable "s3_gateway_policy_accounts" {
}

#Placeholder for real value, passed as a secret
variable "block_range_20" {
default = "192.168.0.0/32"
}
variable "cidr_blocks" {
type = list(string)
default = ["192.168.0.0/32", "192.168.0.1/32"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we want to set any default values. Because if we happened to not pass the real values through in CI automatically, then traffic from these default CIDRs would get blocked

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Valid point, I had these for testing but removed with a new commit

}

22 changes: 12 additions & 10 deletions terraform/modules/bosh_vpc/vpc.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,25 +78,27 @@ data "aws_network_acls" "default" {
vpc_id = aws_vpc.main_vpc.id
}

resource "aws_network_acl_rule" "deny_rule_ingress_rule_20" {
count = length(data.aws_network_acls.default.ids)
rule_number = 20
network_acl_id = data.aws_network_acls.default.ids[count.index]
resource "aws_network_acl_rule" "deny_rule_ingress_rules" {
count = length(var.cidr_blocks)

rule_number = 20 + count.index
network_acl_id = data.aws_network_acls.default.ids[0]
rule_action = "deny"
protocol = "-1"
cidr_block = var.block_range_20
cidr_block = var.cidr_blocks[count.index]
from_port = 0
to_port = 0
egress = false
}

resource "aws_network_acl_rule" "deny_rule_egress_rule_20" {
count = length(data.aws_network_acls.default.ids)
rule_number = 20
network_acl_id = data.aws_network_acls.default.ids[count.index]
resource "aws_network_acl_rule" "deny_rule_egress_rules" {
count = length(var.cidr_blocks)

rule_number = 20 + count.index
network_acl_id = data.aws_network_acls.default.ids[0]
rule_action = "deny"
protocol = "-1"
cidr_block = var.block_range_20
cidr_block = var.cidr_blocks[count.index]
from_port = 0
to_port = 0
egress = true
Expand Down
2 changes: 1 addition & 1 deletion terraform/modules/stack/base/base.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ module "vpc" {
concourse_security_group_cidrs = var.target_concourse_security_group_cidrs
bosh_default_ssh_public_key = var.bosh_default_ssh_public_key
s3_gateway_policy_accounts = var.s3_gateway_policy_accounts
block_range_20 = var.block_range_20
cidr_blocks = var.cidr_blocks
}

module "rds_network" {
Expand Down
5 changes: 3 additions & 2 deletions terraform/modules/stack/base/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,7 @@ variable "s3_gateway_policy_accounts" {


#Placeholder for real value, passed as a secret
variable "block_range_20" {
default = "192.168.0.0/32"
variable "cidr_blocks" {
type = list(string)
default = ["192.168.0.0/32", "192.168.0.1/32"]
}
2 changes: 1 addition & 1 deletion terraform/modules/stack/spoke/spoke.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ module "base" {
restricted_ingress_web_ipv6_cidrs = var.restricted_ingress_web_ipv6_cidrs
bosh_default_ssh_public_key = var.bosh_default_ssh_public_key
s3_gateway_policy_accounts = var.s3_gateway_policy_accounts
block_range_20 = var.block_range_20
cidr_blocks = var.cidr_blocks

rds_security_groups = [
module.base.bosh_security_group,
Expand Down
5 changes: 3 additions & 2 deletions terraform/modules/stack/spoke/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ variable "s3_gateway_policy_accounts" {


#Placeholder for real value, passed as a secret
variable "block_range_20" {
default = "192.168.0.0/32"
variable "cidr_blocks" {
type = list(string)
default = ["192.168.0.0/32", "192.168.0.1/32"]
}
2 changes: 1 addition & 1 deletion terraform/stacks/main/stack.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ module "stack" {
target_account_id = data.aws_caller_identity.tooling.account_id
bosh_default_ssh_public_key = var.bosh_default_ssh_public_key
s3_gateway_policy_accounts = var.s3_gateway_policy_accounts
block_range_20 = var.block_range_20
cidr_blocks = var.cidr_blocks

target_vpc_id = data.terraform_remote_state.target_vpc.outputs.vpc_id
target_vpc_cidr = data.terraform_remote_state.target_vpc.outputs.production_concourse_subnet_cidr
Expand Down
6 changes: 4 additions & 2 deletions terraform/stacks/main/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,9 @@ variable "cg_egress_ip_set_arn" {
description = "ARN of IP set identifying egress IP CIDR ranges for cloud.gov"
}


#Placeholder for real value, passed as a secret
variable "block_range_20" {
default = "192.168.0.0/32"
variable "cidr_blocks" {
type = list(string)
default = ["192.168.0.0/32", "192.168.0.1/32"]
}