Network security groups #117
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bryan-bar
force-pushed
the
service-ports
branch
9 times, most recently
from
d266e89 to
3a21f09
Compare
bryan-bar
force-pushed
the
service-ports
branch
2 times, most recently
from
599cb88 to
c9faf4a
Compare
…signed to 'service_cidrblocks'
…nd allow for setting of defaults to internal, public, or service
…d allow for setting of defaults to internal, public, or service
…allow for setting of defaults to internal, public, or service
bryan-bar
force-pushed
the
service-ports
branch
from
c9faf4a to
b5bbb47
Compare
…s_ports combined as a single list and assigned defaults=service or defaults=internal.
…amic ip may be added to the service_cidrblocks. 0.0.0.0/0 will no longer be set a default to avoid accidental exposure of resources.
…ups to make use of changes
…ps to make use of changes and restrict ips to instance when used within the machine module.
…ups to make use of changes and restrict ips to instance when used within the machine module.
…cks' variable so that a list of cidrblocks can be set to restrict 'public' ports
…ds. We should always run 'terraform state list' to see if a remote backend is set.
…dalone block and each aliased block still requires the features block
…nd raise a helpful message for users
bryan-bar
force-pushed
the
service-ports
branch
from
b5bbb47 to
4cb9e9a
Compare
bryan-bar
force-pushed
the
service-ports
branch
from
4cb9e9a to
7c6ba44
Compare
…idr range so port rules only target the region it is configured in. This is not needed for AWS since a security group is created and attached to the VPC.
bryan-bar
force-pushed
the
service-ports
branch
from
7c6ba44 to
a8ccc07
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
BREAKING CHANGES:
service_cidrblocksdefault open access removed. This can lead to unexpected open ports and expose resources that are not properly secured. You can still manually set0.0.0.0/0or make use of the new cli options to dynamically set the service cidr blocks.Changes:
service_cidrblockscan be updated with a list of cidrs to amend the ip allowlist for service connections.TF_VAR_service_cidrblocks='["100.100.200.4/32"]' terraform applyforce_dynamic_ipcan be set to fetch the controller's ip to be appended to theservice_cidrblocks.TF_VAR_force_dynamic_ip=true terraform applydefaultsis unused by default to avoid unexpected open connections.defaultsoptions available:internal- region cidrblocks for internal networkingpublic- any access cidrblocksservice- service access cidrblocks""- no cidrblock defaults