Skip to content

Remove mention of IP allowlist for bastion #819

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 25, 2025
Merged

Remove mention of IP allowlist for bastion #819

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 2 additions & 53 deletions src/infra/docs/bastion.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,9 @@ To log into a server through the bastion, use one of the following methods:
ssh <username>@servername.infra.rust-lang.org
```

Please remember the bastion server only allows connections from a small list of
IP addresses. Infra team members with AWS access can change the whitelist, but
it's good practice to either have your own bastion server or a static IP
address.

The SSH keys authorized to log into each account are stored in the [simpleinfra
repository][keys]. Additionally, people with sensitive 1password access can use
the master key stored in the vault to log into every account, provided their
connection comes from any whitelisted IP.
the master key stored in the vault to log into every account.

## Common maintenance procedures

Expand All @@ -55,55 +49,10 @@ the [Ansible playbook][ansible] adding the user to the list of unprivileged
users. Please leave a comment clarifying which servers the user will have
access to.

Once that's done [apply the playbook][ansible-apply] and [add a new whitelisted
IP address](#adding-a-whitelisted-ip).

## Editing a whitelisted IP

Due to privacy reasons, all the static IP addresses of team members with access
to the bastion are stored on [AWS SSM Parameter Store][ssm] instead of public
git repositories.
When running the following commands, replace `USERNAME` and `IP_ADDRESS` with the proper values.

### Adding a whitelisted IP

1. Run:
```
aws ssm put-parameter --type String --name "/prod/bastion/allowed-ips/USERNAME" --value "IP_ADDRESS/32" --region us-west-1
```
2. Add the username to the list in
[`terraform/bastion/firewall.tf`][allowed-ips] (local variable
`allowed_users`).
3. [apply the Terraform configuration][terraform-apply].

### Updating a whitelisted IP

1. Run:

```
aws ssm put-parameter --overwrite --type String --name "/prod/bastion/allowed-ips/USERNAME" --value "IP_ADDRESS/32" --region us-west-1
```

2. [apply the Terraform configuration][terraform-apply].

### Removing a whitelisted IP

1. Run:

```
aws ssm delete-parameter --name "/prod/bastion/allowed-ips/USERNAME" --region us-west-1
```

2. Remove the username from the list in
[`terraform/bastion/firewall.tf`][allowed-ips] (local variable
`allowed_users`).
3. [apply the Terraform configuration][terraform-apply].
Once that's done [apply the playbook][ansible-apply].

[ansible]: https://github.com/rust-lang/simpleinfra/blob/master/ansible/playbooks/bastion.yml
[terraform]: https://github.com/rust-lang/simpleinfra/tree/master/terraform/bastion
[grafana]: https://grafana.rust-lang.org/d/rpXrFfKWz/instance-metrics?orgId=1&var-instance=bastion.infra.rust-lang.org:9100
[keys]: https://github.com/rust-lang/simpleinfra/tree/master/ansible/roles/common/files/ssh-keys
[ansible-apply]: https://github.com/rust-lang/simpleinfra/blob/master/ansible/README.md#executing-a-playbook
[ssm]: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
[allowed-ips]: https://github.com/rust-lang/simpleinfra/blob/master/terraform/bastion/firewall.tf
[terraform-apply]: https://github.com/rust-lang/simpleinfra/tree/master/terraform#applying-the-configuration