feat: Ability to restrict inbound CIDRs for public endpoints (#1837)

Author: niallthomson

hack/deploy-ide-cfn.sh

@@ -10,5 +10,8 @@ outfile=$(mktemp)
 
 bash $SCRIPT_DIR/build-ide-cfn.sh $outfile
 
+source $SCRIPT_DIR/lib/resolve-source-ip.sh
+
 aws cloudformation deploy --stack-name "$EKS_CLUSTER_NAME-ide" \
-  --capabilities CAPABILITY_NAMED_IAM --disable-rollback --template-file $outfile
+  --capabilities CAPABILITY_NAMED_IAM --disable-rollback --template-file $outfile \
+  --parameter-overrides InboundCIDR="$INBOUND_CIDRS"

hack/lib/resolve-source-ip.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Resolves SOURCE_IP_ADDRESS to INBOUND_CIDRS
+# If SOURCE_IP_ADDRESS is blank or "auto", resolves the current public IP
+# Otherwise uses the provided value verbatim
+
+if [ -z "${SOURCE_IP_ADDRESS:-}" ] || [ "${SOURCE_IP_ADDRESS:-}" = "auto" ]; then
+  SOURCE_IP_ADDRESS=$(curl -s https://checkip.amazonaws.com)
+  echo "Resolved source IP address: ${SOURCE_IP_ADDRESS}"
+else
+  echo "Using provided source IP address: ${SOURCE_IP_ADDRESS}"
+fi
+
+export INBOUND_CIDRS="${SOURCE_IP_ADDRESS}/32"
+echo "Inbound CIDRs: ${INBOUND_CIDRS}"

hack/run-tests.sh

@@ -74,6 +74,8 @@ fi
 
 RESOURCES_PRECREATED=${RESOURCES_PRECREATED:-""}
 
+source $SCRIPT_DIR/lib/resolve-source-ip.sh
+
 echo "Running test suite..."
 
 # get current IDs
@@ -86,7 +88,7 @@ $CONTAINER_CLI run $background_args $dns_args \
   --name $container_name \
   -v $SCRIPT_DIR/../website/docs:/content \
   -v $SCRIPT_DIR/../manifests:/eks-workshop/manifests \
-  -e 'EKS_CLUSTER_NAME' -e 'AWS_REGION' -e 'RESOURCES_PRECREATED' \
+  -e 'EKS_CLUSTER_NAME' -e 'AWS_REGION' -e 'RESOURCES_PRECREATED' -e 'INBOUND_CIDRS' \
   $aws_credential_args $container_image -g "${actual_glob}" --hook-timeout 3600 --timeout 3600 $output_args ${AWS_EKS_WORKSHOP_TEST_FLAGS} || exit_code=$?
 
 if [ $exit_code -eq 0 ]; then

hack/shell.sh

@@ -37,9 +37,11 @@ if [ ! -z "$DOCKER_DNS_OVERRIDE" ]; then
   dns_args="--dns=$DOCKER_DNS_OVERRIDE"
 fi
 
+source $SCRIPT_DIR/lib/resolve-source-ip.sh
+
 $CONTAINER_CLI run --rm $interactive_args $dns_args \
   -v $SCRIPT_DIR/../manifests:/eks-workshop/manifests \
   -v $SCRIPT_DIR/../cluster:/cluster \
-  -e 'EKS_CLUSTER_NAME' -e 'AWS_REGION' \
+  -e 'EKS_CLUSTER_NAME' -e 'AWS_REGION' -e 'INBOUND_CIDRS' \
   -p 8889:8889 \
   $aws_credential_args $container_image $shell_command

hack/validate-terraform.sh

@@ -30,6 +30,7 @@ module "gen-$target" {
   addon_context             = local.addon_context
   tags                      = local.tags
   resources_precreated      = var.resources_precreated
+  inbound_cidrs             = "0.0.0.0/0"
 }
 EOF
 done

lab/bin/reset-environment

@@ -136,6 +136,7 @@ mkdir -p /eks-workshop/terraform-data
 export TF_DATA_DIR="/eks-workshop/terraform-data"
 
 export TF_VAR_eks_cluster_id="$EKS_CLUSTER_NAME"
+export TF_VAR_inbound_cidrs="${INBOUND_CIDRS:-0.0.0.0/0}"
 
 RESOURCES_PRECREATED=${RESOURCES_PRECREATED:-"false"}
 

lab/cfn/eks-workshop-vscode-cfn.yaml

@@ -39,6 +39,10 @@ Parameters:
     Type: String
     Description: For testing purposes only
     Default: ""
+  InboundCIDR:
+    Type: String
+    Description: CIDR range to allowlist for inbound traffic
+    Default: "0.0.0.0/0"
 
 Mappings:
   PrefixListID:
@@ -309,6 +313,9 @@ Resources:
                   export REPOSITORY_REF="${RepositoryRef}"
                   export RESOURCES_PRECREATED="${ResourcesPrecreated}"
                   export ANALYTICS_ENDPOINT="${AnalyticsEndpoint}"
+                  IMDS_TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+                  IDE_IP=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4)
+                  export INBOUND_CIDRS="${InboundCIDR},$IDE_IP/32"
 
                   curl -fsSL https://raw.githubusercontent.com/${RepositoryOwner}/${RepositoryName}/${RepositoryRef}/lab/scripts/installer.sh | bash
 

lab/scripts/setup.sh

@@ -58,6 +58,8 @@ echo "export RESOURCES_PRECREATED='${RESOURCES_PRECREATED}'" > ~/.bashrc.d/infra
 
 echo "export ANALYTICS_ENDPOINT='${ANALYTICS_ENDPOINT}'" > ~/.bashrc.d/analytics.bash
 
+echo "export INBOUND_CIDRS='${INBOUND_CIDRS}'" > ~/.bashrc.d/inbound-cidr.bash
+
 /usr/local/bin/kubectl completion bash >  ~/.bashrc.d/kubectl_completion.bash
 echo "alias k=kubectl" >> ~/.bashrc.d/kubectl_completion.bash
 echo "complete -F __start_kubectl k" >> ~/.bashrc.d/kubectl_completion.bash

manifests/.workshop/terraform/base.tf

@@ -45,6 +45,13 @@ variable "resources_precreated" {
   default     = false
 }
 
+# tflint-ignore: terraform_unused_declarations
+variable "inbound_cidrs" {
+  description = "CIDR range to allowlist for inbound traffic"
+  type        = string
+  default     = "0.0.0.0/0"
+}
+
 data "aws_partition" "current" {}
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}

manifests/.workshop/terraform/lab.tf

@@ -7,6 +7,7 @@ module "lab" {
   addon_context             = local.addon_context
   tags                      = local.tags
   resources_precreated      = var.resources_precreated
+  inbound_cidrs             = var.inbound_cidrs
 }
 
 locals {