Skip to content

Commit 8eb28ce

Browse files
LangleuLangleu
authored
chore: limit access to cidr ranges and optimize nat egress (#44)
* chore: disable aws provider and move to override * chore: allow limiting access to cidr ranges * fix: script adjustments and ssh within vpc * fix: allow ec2 instances to pull outside data * chore: update golden file + recreation * chore: add requestTimeout to zbctl command * fix: properly configure security groups for nlb * chore: restructure ports and remove duplicate egress * chore: remove commented egress rule forgot to completly remove it in the last commit
1 parent 3468dc8 commit 8eb28ce

18 files changed

+245
-138
lines changed

‎.github/workflows/aws_ec2_golden.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,9 @@ jobs:
5959
aws configure set aws_access_key_id ${{ steps.secrets.outputs.AWS_ACCESS_KEY }} --profile ${{ env.AWS_PROFILE }}
6060
aws configure set aws_secret_access_key ${{ steps.secrets.outputs.AWS_SECRET_KEY }} --profile ${{ env.AWS_PROFILE }}
6161
aws configure set region ${{ env.AWS_REGION }} --profile ${{ env.AWS_PROFILE }}
62+
- name: Copy provider override
63+
run: |
64+
cp "${{ github.workspace }}/aws/ec2/test/fixtures/provider_override.tf" "${TF_PATH}/provider_override.tf"
6265
- name: Run Terraform plan
6366
working-directory: aws/ec2/terraform
6467
run: |

‎.github/workflows/aws_ec2_tests.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ jobs:
8080
# yamllint disable rule:line-length
8181
- name: Configure Terraform Backend
8282
run: |
83-
cp ${{ github.workspace }}/aws/ec2/test/fixtures/override.tf ${{ github.workspace }}/aws/ec2/terraform/override.tf
83+
cp ${{ github.workspace }}/aws/ec2/test/fixtures/*.tf ${{ github.workspace }}/aws/ec2/terraform/
8484
echo "TF_CLI_ARGS_init=-backend-config='bucket=${{ env.S3_BACKEND_BUCKET }}' -backend-config='key=state/${{ env.TF_PREFIX }}/terraform.tfstate' -backend-config='region=${{ env.S3_BUCKET_REGION }}' -backend-config='encrypt=true'" >> "$GITHUB_ENV"
8585
# yamllint enable rule:line-length
8686
- name: Set Camunda version
@@ -103,10 +103,6 @@ jobs:
103103
mkdir /home/runner/.ssh
104104
touch /home/runner/.ssh/config
105105
106-
# go install github.com/jstemmer/go-junit-report/v2@latest
107-
# go test -v -failfast -timeout 120m | go-junit-report -iocopy -set-exit-code -out report.xml
108-
# go install github.com/ctrf-io/go-ctrf-json-reporter/cmd/go-ctrf-json-reporter@latest
109-
# go test -v -failfast -timeout 120m -json | go-ctrf-json-reporter -output report.json -verbose
110106
go install gotest.tools/gotestsum@latest
111107
go run gotest.tools/gotestsum@latest --junitfile tests.xml -- --timeout=120m
112108
################ Cleanup ##################

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,8 @@ crash.*.log
7171

7272
# Ignore override files as they are usually used to override resources locally and so
7373
# are not checked in
74+
override.tf
7475
override.tf.json
75-
*_override.tf
7676
*_override.tf.json
7777

7878
# Include override files you do wish to add to version control using negated pattern

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ repos:
4545
hooks:
4646
- id: terraform_fmt
4747
- id: terraform_tflint
48+
exclude: (_override.tf)
4849
- id: terraform_docs
4950
args:
5051
- --hook-config=--path-to-file=README.md

‎README.md‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎aws/ec2/scripts/all-in-one-install.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,12 @@ if [ -z "${IPS+x}" ]; then
4848
IPS_JSON=$(terraform -chdir="${CURRENT_DIR}/../terraform" output -json camunda_ips)
4949
cleaned_str=$(echo "${IPS_JSON}" | tr -d '[]"')
5050
read -r -a IPS <<< "$(echo "${cleaned_str}" | tr ',' ' ')"
51+
else
52+
# IPS env var can be supplied as "IP1 IP2 IP3"
53+
read -r -a IPS <<< "${IPS[@]}"
5154
fi
5255

53-
echo "[INFO] Detected following values for IPS: ${cleaned_str}"
56+
echo "[INFO] Detected following values for IPS: ${IPS[*]}"
5457

5558
if [ -z "${BASTION_IP+x}" ]; then
5659
echo "[INFO] BASTION_IP was not overwritten via env vars... pulling from Terraform state file."

‎aws/ec2/terraform/README.md‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -122,37 +122,38 @@ SECURITY: The default is false. If set to true will use self-signed certificates
122122

123123
| Name | Type |
124124
|------|------|
125-
| [aws_ebs_volume.camunda](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/ebs_volume) | resource |
126-
| [aws_iam_instance_profile.cloudwatch_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/iam_instance_profile) | resource |
127-
| [aws_iam_policy.cloudwatch_policy](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/iam_policy) | resource |
128-
| [aws_iam_role.cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/iam_role) | resource |
129-
| [aws_iam_role_policy_attachment.cloudwatch_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/iam_role_policy_attachment) | resource |
130-
| [aws_instance.bastion](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/instance) | resource |
131-
| [aws_instance.camunda](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/instance) | resource |
132-
| [aws_key_pair.main](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/key_pair) | resource |
133-
| [aws_kms_key.main](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/kms_key) | resource |
134-
| [aws_lb.grpc](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb) | resource |
135-
| [aws_lb.main](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb) | resource |
136-
| [aws_lb_listener.grpc_26500](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_listener) | resource |
137-
| [aws_lb_listener.http_8080](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_listener) | resource |
138-
| [aws_lb_listener.http_9090](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_listener) | resource |
139-
| [aws_lb_target_group.connectors](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_target_group) | resource |
140-
| [aws_lb_target_group.grpc](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_target_group) | resource |
141-
| [aws_lb_target_group.main](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_target_group) | resource |
142-
| [aws_lb_target_group_attachment.connectors](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_target_group_attachment) | resource |
143-
| [aws_lb_target_group_attachment.grpc](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_target_group_attachment) | resource |
144-
| [aws_lb_target_group_attachment.main](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/lb_target_group_attachment) | resource |
145-
| [aws_security_group.allow_necessary_camunda_ports_within_vpc](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/security_group) | resource |
146-
| [aws_security_group.allow_remote_80_443](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/security_group) | resource |
147-
| [aws_security_group.allow_remote_9090](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/security_group) | resource |
148-
| [aws_security_group.allow_remote_grpc](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/security_group) | resource |
149-
| [aws_security_group.allow_ssh](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/security_group) | resource |
150-
| [aws_volume_attachment.ebs_attachment](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/resources/volume_attachment) | resource |
151-
| [tls_private_key.testing](https://registry.terraform.io/providers/hashicorp/tls/4.0.6/docs/resources/private_key) | resource |
152-
| [aws_ami.debian](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/data-sources/ami) | data source |
153-
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/data-sources/availability_zones) | data source |
154-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/data-sources/caller_identity) | data source |
155-
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/5.73.0/docs/data-sources/region) | data source |
125+
| [aws_ebs_volume.camunda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume) | resource |
126+
| [aws_iam_instance_profile.cloudwatch_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
127+
| [aws_iam_policy.cloudwatch_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
128+
| [aws_iam_role.cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
129+
| [aws_iam_role_policy_attachment.cloudwatch_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
130+
| [aws_instance.bastion](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
131+
| [aws_instance.camunda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
132+
| [aws_key_pair.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource |
133+
| [aws_kms_key.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
134+
| [aws_lb.grpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb) | resource |
135+
| [aws_lb.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb) | resource |
136+
| [aws_lb_listener.grpc_26500](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |
137+
| [aws_lb_listener.http_8080](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |
138+
| [aws_lb_listener.http_9090](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |
139+
| [aws_lb_target_group.connectors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
140+
| [aws_lb_target_group.grpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
141+
| [aws_lb_target_group.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
142+
| [aws_lb_target_group_attachment.connectors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |
143+
| [aws_lb_target_group_attachment.grpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |
144+
| [aws_lb_target_group_attachment.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |
145+
| [aws_security_group.allow_necessary_camunda_ports_within_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
146+
| [aws_security_group.allow_package_80_443](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
147+
| [aws_security_group.allow_remote_80_443](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
148+
| [aws_security_group.allow_remote_9090](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
149+
| [aws_security_group.allow_remote_grpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
150+
| [aws_security_group.allow_ssh](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
151+
| [aws_volume_attachment.ebs_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/volume_attachment) | resource |
152+
| [tls_private_key.testing](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
153+
| [aws_ami.debian](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
154+
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
155+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
156+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
156157
## Inputs
157158

158159
| Name | Description | Type | Default | Required |
@@ -170,11 +171,13 @@ SECURITY: The default is false. If set to true will use self-signed certificates
170171
| <a name="input_enable_vpc_logging"></a> [enable\_vpc\_logging](#input\_enable\_vpc\_logging) | Enable VPC flow logging to CloudWatch Logs | `bool` | `false` | no |
171172
| <a name="input_generate_ssh_key_pair"></a> [generate\_ssh\_key\_pair](#input\_generate\_ssh\_key\_pair) | Generate an SSH key pair for the EC2 instances over the use of pub\_key\_path. Meant for testing purposes / temp environments. | `bool` | `false` | no |
172173
| <a name="input_instance_count"></a> [instance\_count](#input\_instance\_count) | The number of instances to create | `number` | `3` | no |
174+
| <a name="input_limit_access_to_cidrs"></a> [limit\_access\_to\_cidrs](#input\_limit\_access\_to\_cidrs) | List of CIDR blocks to allow access to ssh of Bastion and LoadBalancer | `list(string)` | <pre>[<br/> "0.0.0.0/0"<br/>]</pre> | no |
173175
| <a name="input_opensearch_disk_size"></a> [opensearch\_disk\_size](#input\_opensearch\_disk\_size) | The size of the OpenSearch disk in GiB | `number` | `50` | no |
174176
| <a name="input_opensearch_engine_version"></a> [opensearch\_engine\_version](#input\_opensearch\_engine\_version) | The engine version of the OpenSearch cluster | `string` | `"2.15"` | no |
175177
| <a name="input_opensearch_instance_count"></a> [opensearch\_instance\_count](#input\_opensearch\_instance\_count) | The number of instances to create | `number` | `3` | no |
176178
| <a name="input_opensearch_instance_type"></a> [opensearch\_instance\_type](#input\_opensearch\_instance\_type) | The instance type to use for the OpenSearch instances | `string` | `"t3.small.search"` | no |
177179
| <a name="input_opensearch_log_types"></a> [opensearch\_log\_types](#input\_opensearch\_log\_types) | The types of logs to publish to CloudWatch Logs | `list(string)` | <pre>[<br/> "SEARCH_SLOW_LOGS",<br/> "INDEX_SLOW_LOGS",<br/> "ES_APPLICATION_LOGS"<br/>]</pre> | no |
180+
| <a name="input_ports"></a> [ports](#input\_ports) | The ports to open for the security groups within the VPC | `map(number)` | <pre>{<br/> "camunda_metrics_endpoint": 9600,<br/> "camunda_web_ui": 8080,<br/> "connectors_port": 9090,<br/> "opensearch_https": 443,<br/> "ssh": 22,<br/> "zeebe_broker_network_command_api_port": 26501,<br/> "zeebe_gateway_cluster_port": 26502,<br/> "zeebe_gateway_network_port": 26500<br/>}</pre> | no |
178181
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix to use for names of resources | `string` | `"camunda"` | no |
179182
| <a name="input_pub_key_path"></a> [pub\_key\_path](#input\_pub\_key\_path) | The path to the public key to use for the EC2 instances for SSH access | `string` | `"~/.ssh/id_rsa.pub"` | no |
180183
## Outputs
@@ -187,6 +190,7 @@ SECURITY: The default is false. If set to true will use self-signed certificates
187190
| <a name="output_bastion_ip"></a> [bastion\_ip](#output\_bastion\_ip) | (Optional) The public IP address of the Bastion instance. |
188191
| <a name="output_camunda_ips"></a> [camunda\_ips](#output\_camunda\_ips) | The private IP addresses of the Camunda instances. |
189192
| <a name="output_nlb_endpoint"></a> [nlb\_endpoint](#output\_nlb\_endpoint) | (Optional) The DNS name of the Network Load Balancer (NLB) to access the Camunda REST API. |
193+
| <a name="output_ports"></a> [ports](#output\_ports) | The ports to open in the security group within the VPC. For easier consumption in scripts. |
190194
| <a name="output_private_key"></a> [private\_key](#output\_private\_key) | (Optional) This private key is meant for testing purposes only and enabled via the variable `generate_ssh_key_pair`. |
191195
| <a name="output_public_key"></a> [public\_key](#output\_public\_key) | (Optional) This public key is meant for testing purposes only and enabled via the variable `generate_ssh_key_pair`. Please supply your own public key via the variable `pub_key_path`. |
192196
<!-- END_TF_DOCS -->

‎aws/ec2/terraform/config.tf‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,21 +7,23 @@ terraform {
77
required_providers {
88
aws = {
99
source = "hashicorp/aws"
10-
version = "5.73.0"
10+
version = "~> 5.74"
1111
}
1212
tls = {
1313
source = "hashicorp/tls"
14-
version = "4.0.6"
14+
version = "~> 4.0"
1515
}
1616
}
1717
}
1818

19-
provider "aws" {
20-
# set region via $AWS_REGION environment variable
19+
# Uncomment if used as reference architecture
20+
# If used as module, a provider configuration is not allowed to be defined
21+
# provider "aws" {
22+
# # set region via $AWS_REGION environment variable
2123

22-
default_tags {
23-
tags = {
24-
managed_by = "Terraform"
25-
}
26-
}
27-
}
24+
# default_tags {
25+
# tags = {
26+
# managed_by = "Terraform"
27+
# }
28+
# }
29+
# }

‎aws/ec2/terraform/ec2.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ resource "aws_instance" "camunda" {
99

1010
vpc_security_group_ids = [
1111
aws_security_group.allow_necessary_camunda_ports_within_vpc.id,
12-
aws_security_group.allow_remote_80_443.id,
12+
aws_security_group.allow_package_80_443.id,
1313
aws_security_group.allow_remote_grpc.id,
1414
]
1515

‎aws/ec2/terraform/lb.tf‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,10 @@ resource "aws_lb" "grpc" {
139139
name = "${var.prefix}-nlb-grpc"
140140
internal = false
141141
load_balancer_type = "network"
142+
security_groups = [
143+
aws_security_group.allow_remote_grpc.id,
144+
aws_security_group.allow_necessary_camunda_ports_within_vpc.id,
145+
]
142146

143147
subnets = module.vpc.public_subnets
144148
}
@@ -147,7 +151,7 @@ resource "aws_lb_listener" "grpc_26500" {
147151
count = var.enable_nlb ? 1 : 0
148152

149153
load_balancer_arn = aws_lb.grpc[0].arn
150-
port = "80"
154+
port = "26500"
151155
protocol = "TCP"
152156

153157
default_action {

0 commit comments

Comments
 (0)