johnstanfield · September 28, 2020 05:12 · Sep 28, 2020
diff --git a/entry-point.sh b/entry-point.sh
@@ -0,0 +1,19 @@
+# i'm running cloudflare RailGun in a Fargate task, in a public subnet, with a public IP address.
+# i need to ensure the web servers do not allow public access; only access from this Fargate task or CloudFlare's IPs
+# this presents an interesting problem: Fargate tasks can't use Elastic IPs, so the IP will change each time a task runs,
+# making security groups tough
+
+# what i do is:
+# create a prefix list (this is a list of IP addresses at AWS)
+# add a security group called web_railgun that uses the prefix list; attach that security group to the load balancer
+# replace the IP address (cidr) entry in the prefix list when the task boots
+
+if [ "$UPDATE_MANAGED_PREFIX_LIST" != "" ]; then
+  prefix_list_version=`aws ec2 describe-managed-prefix-lists --filters Name=prefix-list-id,Values=$UPDATE_MANAGED_PREFIX_LIST | jq '.PrefixLists[].Version' --raw-output`
+  for cidr in `aws ec2 get-managed-prefix-list-entries --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST | jq '.Entries[].Cidr' --raw-output`; do
+    aws ec2 modify-managed-prefix-list --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST --current-version $prefix_list_version --remove-entries Cidr=$cidr
+    prefix_list_version=`aws ec2 describe-managed-prefix-lists --filters Name=prefix-list-id,Values=$UPDATE_MANAGED_PREFIX_LIST | jq '.PrefixLists[].Version' --raw-output`
+  done
+  my_ip=`curl http://icanhazip.com`
+  aws ec2 modify-managed-prefix-list --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST --current-version $prefix_list_version --add-entries Cidr=$my_ip/32,Description=fargate
+fi
diff --git a/lb.tf b/lb.tf
@@ -0,0 +1,41 @@
+# terraform config for the load balancer and security groups
+
+resource "aws_lb" "lb" {
+  name               = var.env_name
+  internal           = false
+  load_balancer_type = "application"
+  subnets            = aws_subnet.app_public.*.id
+  security_groups    = [aws_security_group.web.id,aws_security_group.web_railgun.id]
+  enable_cross_zone_load_balancing = true
+  idle_timeout       = 180
+
+  tags = {
+    Name = var.env_name
+  }
+}
+
+resource "aws_security_group" "web_railgun" {
+  name        = "${var.env_name}-allow_http_railgun"
+  description = "Allow HTTP traffic from Railgun"
+  vpc_id      = "${aws_vpc.app.id}"
+}
+
+resource "aws_security_group_rule" "https_ingress_railgun" {
+  type            = "ingress"
+  from_port       = 443
+  to_port         = 443
+  protocol        = "6"
+  prefix_list_ids = [var.railgun_prefix_list_id]
+
+  security_group_id = aws_security_group.web_railgun.id
+}
+
+resource "aws_security_group_rule" "http_ingress_railgun" {
+  type            = "ingress"
+  from_port       = 80
+  to_port         = 80
+  protocol        = "6"
+  prefix_list_ids = [var.railgun_prefix_list_id]
+
+  security_group_id = aws_security_group.web_railgun.id
+}
diff --git a/prefix-list.tf b/prefix-list.tf
@@ -0,0 +1,3 @@
+# there is no way to create a managed prefix list in Terraform
+# just go to the console under VPCs and create one
+# its ID is used for the railgun_prefix_list_id Terraform variable and the UPDATE_MANAGED_PREFIX_LIST env variable
No results found