Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lockdown ECS ALB to only allow Shared Services connections #11

Merged
merged 5 commits into from
Jan 22, 2025
Merged

Lockdown ECS ALB to only allow Shared Services connections #11

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4ebce2e
incomplete, need to find fetch-ssm-from-other-account example
jpl-btlunsfo Sep 3, 2024
5d3d989
adding proper syntax for cross-account reference
jpl-btlunsfo Sep 3, 2024
9a935b6
removing commented unused code
jpl-btlunsfo Jan 19, 2025
bcf04ac
changing to security-group-based allow rules
jpl-btlunsfo Jan 22, 2025
d0043c4
need to specify value not id
jpl-btlunsfo Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 22 additions & 12 deletions terraform-unity/networking.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# Create an Application Load Balancer (ALB)
resource "aws_lb" "httpd_alb" {
name = "${var.project}-${var.venue}-httpd-alb"
internal = false
internal = true
load_balancer_type = "application"
security_groups = [aws_security_group.ecs_alb_sg.id]
subnets = local.public_subnet_ids
subnets = local.subnet_ids
enable_deletion_protection = false
preserve_host_header = true
tags = {
Expand Down Expand Up @@ -110,16 +110,6 @@ resource "aws_vpc_security_group_ingress_rule" "ecs_alb_ingress_sg_rule" {
referenced_security_group_id = aws_security_group.ecs_alb_sg.id
}

# Add a new ingress rule to the ECS ALB's security group, opening it up to other connections
#tfsec:ignore:AVD-AWS-0107
resource "aws_vpc_security_group_ingress_rule" "alb_all_ingress_sg_rule" {
security_group_id = aws_security_group.ecs_alb_sg.id
to_port = 8080
from_port = 8080
ip_protocol = "tcp"
cidr_ipv4 = "0.0.0.0/0"
}

# Add a new egress rule to the ECS's security group, allowing ECS to fetch the container images/proxy
resource "aws_vpc_security_group_egress_rule" "ecs_egress_sg_rule" {
security_group_id = aws_security_group.ecs_sg.id
Expand All @@ -137,3 +127,23 @@ resource "aws_vpc_security_group_egress_rule" "ecs_alb_egress_sg_rule" {
ip_protocol = "tcp"
cidr_ipv4 = "0.0.0.0/0"
}

data "aws_ssm_parameter" "shared-services_security_group" {
name = "arn:aws:ssm:${data.aws_ssm_parameter.shared_service_region.value}:${data.aws_ssm_parameter.shared_service_account_id.value}:parameter/unity/shared-services/network/httpd_security_group"
}

resource "aws_vpc_security_group_ingress_rule" "ecs_alb_sg_ingress_rule" {
security_group_id = aws_security_group.ecs_alb_sg.id
from_port = 8080
to_port = 8080
ip_protocol = "tcp"
referenced_security_group_id = data.aws_ssm_parameter.shared-services_security_group.value
}

resource "aws_vpc_security_group_egress_rule" "ecs_sg_egress_rule" {
security_group_id = aws_security_group.ecs_sg.id
from_port = 0
to_port = 65535
ip_protocol = "tcp"
referenced_security_group_id = data.aws_security_group.mc_alb_sg.id
}
Loading