Skip to content

Instantly share code, notes, and snippets.

@johnstanfield

johnstanfield/entry-point.sh

Created September 28, 2020 05:12
Show Gist options
  • Save johnstanfield/a6949ead321dc598b9dd9fc3f71cfecc to your computer and use it in GitHub Desktop.
Save johnstanfield/a6949ead321dc598b9dd9fc3f71cfecc to your computer and use it in GitHub Desktop.
Download ZIP
updating a prefix list at AWS when a task boots
Raw
entry-point.sh
# i'm running cloudflare RailGun in a Fargate task, in a public subnet, with a public IP address.
# i need to ensure the web servers do not allow public access; only access from this Fargate task or CloudFlare's IPs
# this presents an interesting problem: Fargate tasks can't use Elastic IPs, so the IP will change each time a task runs,
# making security groups tough
# what i do is:
# create a prefix list (this is a list of IP addresses at AWS)
# add a security group called web_railgun that uses the prefix list; attach that security group to the load balancer
# replace the IP address (cidr) entry in the prefix list when the task boots
if [ "$UPDATE_MANAGED_PREFIX_LIST" != "" ]; then
prefix_list_version=`aws ec2 describe-managed-prefix-lists --filters Name=prefix-list-id,Values=$UPDATE_MANAGED_PREFIX_LIST | jq '.PrefixLists[].Version' --raw-output`
for cidr in `aws ec2 get-managed-prefix-list-entries --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST | jq '.Entries[].Cidr' --raw-output`; do
aws ec2 modify-managed-prefix-list --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST --current-version $prefix_list_version --remove-entries Cidr=$cidr
prefix_list_version=`aws ec2 describe-managed-prefix-lists --filters Name=prefix-list-id,Values=$UPDATE_MANAGED_PREFIX_LIST | jq '.PrefixLists[].Version' --raw-output`
done
my_ip=`curl http://icanhazip.com`
aws ec2 modify-managed-prefix-list --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST --current-version $prefix_list_version --add-entries Cidr=$my_ip/32,Description=fargate
fi
Raw
lb.tf
# terraform config for the load balancer and security groups
resource "aws_lb" "lb" {
name = var.env_name
internal = false
load_balancer_type = "application"
subnets = aws_subnet.app_public.*.id
security_groups = [aws_security_group.web.id,aws_security_group.web_railgun.id]
enable_cross_zone_load_balancing = true
idle_timeout = 180
tags = {
Name = var.env_name
}
}
resource "aws_security_group" "web_railgun" {
name = "${var.env_name}-allow_http_railgun"
description = "Allow HTTP traffic from Railgun"
vpc_id = "${aws_vpc.app.id}"
}
resource "aws_security_group_rule" "https_ingress_railgun" {
type = "ingress"
from_port = 443
to_port = 443
protocol = "6"
prefix_list_ids = [var.railgun_prefix_list_id]
security_group_id = aws_security_group.web_railgun.id
}
resource "aws_security_group_rule" "http_ingress_railgun" {
type = "ingress"
from_port = 80
to_port = 80
protocol = "6"
prefix_list_ids = [var.railgun_prefix_list_id]
security_group_id = aws_security_group.web_railgun.id
}
Raw
prefix-list.tf
# there is no way to create a managed prefix list in Terraform
# just go to the console under VPCs and create one
# its ID is used for the railgun_prefix_list_id Terraform variable and the UPDATE_MANAGED_PREFIX_LIST env variable
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment