Pass ui_allow_list from main (#20)

* Pass ui_allow_list from main

* Deny all ingress to UI by default

Author: olivermeyer

README.md

@@ -113,6 +113,7 @@ You can find a more complete example that uses this module but also includes set
 | <a name="input_subnet2_id"></a> [subnet2\_id](#input\_subnet2\_id) | Second subnet used for availability zone redundancy | `string` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | aws tags | `map(string)` | n/a | yes |
 | <a name="input_ui_alb_internal"></a> [ui\_alb\_internal](#input\_ui\_alb\_internal) | Defines whether the ALB for the UI is internal | `bool` | `false` | no |
+| <a name="input_ui_allow_list"></a> [ui\_allow\_list](#input\_ui\_allow\_list) | List of CIDRs we want to grant access to our Metaflow UI Service. Usually this is our VPN's CIDR blocks. | `list(string)` | `[]` | no |
 | <a name="input_ui_certificate_arn"></a> [ui\_certificate\_arn](#input\_ui\_certificate\_arn) | SSL certificate for UI. If set to empty string, UI is disabled. | `string` | `""` | no |
 | <a name="input_ui_static_container_image"></a> [ui\_static\_container\_image](#input\_ui\_static\_container\_image) | Container image for the UI frontend app | `string` | `""` | no |
 | <a name="input_vpc_cidr_block"></a> [vpc\_cidr\_block](#input\_vpc\_cidr\_block) | The VPC CIDR block that we'll access list on our Metadata Service API to allow all internal communications | `string` | n/a | yes |

main.tf

@@ -56,6 +56,7 @@ module "metaflow-ui" {
   ui_backend_container_image      = local.metadata_service_container_image
   ui_static_container_image       = local.ui_static_container_image
   alb_internal                    = var.ui_alb_internal
+  ui_allow_list                   = var.ui_allow_list
 
   METAFLOW_DATASTORE_SYSROOT_S3      = module.metaflow-datastore.METAFLOW_DATASTORE_SYSROOT_S3
   certificate_arn                    = var.ui_certificate_arn

modules/ui/README.md

@@ -29,7 +29,7 @@ The services are deployed behind an AWS ALB, and the module will output the ALB
 | <a name="input_standard_tags"></a> [standard\_tags](#input\_standard\_tags) | The standard tags to apply to every AWS resource. | `map(string)` | n/a | yes |
 | <a name="input_subnet1_id"></a> [subnet1\_id](#input\_subnet1\_id) | First private subnet used for availability zone redundancy | `string` | n/a | yes |
 | <a name="input_subnet2_id"></a> [subnet2\_id](#input\_subnet2\_id) | Second private subnet used for availability zone redundancy | `string` | n/a | yes |
-| <a name="input_ui_allow_list"></a> [ui\_allow\_list](#input\_ui\_allow\_list) | A list of CIDRs the UI will be available to | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
+| <a name="input_ui_allow_list"></a> [ui\_allow\_list](#input\_ui\_allow\_list) | A list of CIDRs the UI will be available to | `list(string)` | `[]` | no |
 | <a name="input_ui_backend_container_image"></a> [ui\_backend\_container\_image](#input\_ui\_backend\_container\_image) | Container image for UI backend | `string` | `""` | no |
 | <a name="input_ui_static_container_image"></a> [ui\_static\_container\_image](#input\_ui\_static\_container\_image) | Container image for the UI frontend app | `string` | `""` | no |
 

modules/ui/variables.tf

@@ -113,7 +113,7 @@ variable "ui_static_container_image" {
 variable "ui_allow_list" {
   type        = list(string)
   description = "A list of CIDRs the UI will be available to"
-  default     = ["0.0.0.0/0"]
+  default     = []
 }
 
 variable "alb_internal" {

variables.tf

@@ -118,6 +118,12 @@ variable "ui_certificate_arn" {
   description = "SSL certificate for UI. If set to empty string, UI is disabled. "
 }
 
+variable "ui_allow_list" {
+  type        = list(string)
+  default     = []
+  description = "List of CIDRs we want to grant access to our Metaflow UI Service. Usually this is our VPN's CIDR blocks."
+}
+
 variable "extra_ui_backend_env_vars" {
   type        = map(string)
   default     = {}