Skip to content

Commit 42e782f

Browse files
imprateekshimprateeksh
authored
feat: narrow down network acls for intra vpc connectivity to vpc address space (#471)
1 parent 1e89ae2 commit 42e782f

File tree

10 files changed

+81
-16
lines changed

10 files changed

+81
-16
lines changed

‎.secrets.baseline‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2023-03-21T00:26:22Z",
6+
"generated_at": "2023-03-31T22:07:49Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ You need the following permissions to run this module.
9595
| [ibm_is_vpc_address_prefix.subnet_prefix](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_vpc_address_prefix) | resource |
9696
| [ibm_is_vpc_routing_table.route_table](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_vpc_routing_table) | resource |
9797
| [ibm_is_vpc_routing_table_route.routing_table_routes](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_vpc_routing_table_route) | resource |
98+
| [ibm_is_vpc_address_prefixes.get_address_prefixes](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_vpc_address_prefixes) | data source |
9899

99100
## Inputs
100101

@@ -127,6 +128,7 @@ You need the following permissions to run this module.
127128

128129
| Name | Description |
129130
|------|-------------|
131+
| <a name="output_cidr_blocks"></a> [cidr\_blocks](#output\_cidr\_blocks) | List of CIDR blocks present in VPC stack |
130132
| <a name="output_network_acls"></a> [network\_acls](#output\_network\_acls) | List of shortnames and IDs of network ACLs |
131133
| <a name="output_public_gateways"></a> [public\_gateways](#output\_public\_gateways) | Map of public gateways by zone |
132134
| <a name="output_subnet_detail_list"></a> [subnet\_detail\_list](#output\_subnet\_detail\_list) | A list of subnets containing names, CIDR blocks, and zones. |

‎examples/default/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,5 @@ module "slz_vpc" {
5252
create_authorization_policy_vpc_to_cos = var.create_authorization_policy_vpc_to_cos
5353
existing_cos_instance_guid = ibm_resource_instance.cos_instance[0].guid
5454
existing_storage_bucket_name = ibm_cos_bucket.cos_bucket[0].bucket_name
55+
address_prefixes = var.address_prefixes
5556
}

‎examples/default/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,8 @@ output "cos_bucket_name" {
2626
value = ibm_cos_bucket.cos_bucket[0].bucket_name
2727
description = "COS bucket name"
2828
}
29+
30+
output "cidr_blocks" {
31+
value = module.slz_vpc.cidr_blocks
32+
description = "CIDR values"
33+
}

‎examples/default/variables.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,21 @@ variable "create_authorization_policy_vpc_to_cos" {
6161
type = bool
6262
default = true
6363
}
64+
65+
variable "address_prefixes" {
66+
description = "OPTIONAL - IP range that will be defined for the VPC for a certain location. Use only with manual address prefixes"
67+
type = object({
68+
zone-1 = optional(list(string))
69+
zone-2 = optional(list(string))
70+
zone-3 = optional(list(string))
71+
})
72+
default = {
73+
zone-1 = ["10.10.10.0/24"]
74+
zone-2 = ["10.20.10.0/24"]
75+
zone-3 = ["10.30.10.0/24"]
76+
}
77+
validation {
78+
error_message = "Keys for `use_public_gateways` must be in the order `zone-1`, `zone-2`, `zone-3`."
79+
condition = var.address_prefixes == null ? true : (keys(var.address_prefixes)[0] == "zone-1" && keys(var.address_prefixes)[1] == "zone-2" && keys(var.address_prefixes)[2] == "zone-3")
80+
}
81+
}

‎main.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ resource "ibm_is_vpc_address_prefix" "address_prefixes" {
3636
cidr = each.value.cidr
3737
}
3838

39+
data "ibm_is_vpc_address_prefixes" "get_address_prefixes" {
40+
depends_on = [ibm_is_vpc_address_prefix.address_prefixes, ibm_is_vpc_address_prefix.subnet_prefix]
41+
vpc = ibm_is_vpc.vpc.id
42+
}
3943
##############################################################################
4044

4145

‎module-metadata.json‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,14 @@
372372
}
373373
},
374374
"outputs": {
375+
"cidr_blocks": {
376+
"name": "cidr_blocks",
377+
"description": "List of CIDR blocks present in VPC stack",
378+
"pos": {
379+
"filename": "outputs.tf",
380+
"line": 137
381+
}
382+
},
375383
"network_acls": {
376384
"name": "network_acls",
377385
"description": "List of shortnames and IDs of network ACLs",
@@ -490,7 +498,7 @@
490498
},
491499
"pos": {
492500
"filename": "main.tf",
493-
"line": 102
501+
"line": 106
494502
}
495503
},
496504
"ibm_is_flow_log.flow_logs": {
@@ -510,7 +518,7 @@
510518
},
511519
"pos": {
512520
"filename": "main.tf",
513-
"line": 113
521+
"line": 117
514522
}
515523
},
516524
"ibm_is_network_acl.network_acl": {
@@ -526,7 +534,7 @@
526534
},
527535
"pos": {
528536
"filename": "network_acls.tf",
529-
"line": 133
537+
"line": 137
530538
}
531539
},
532540
"ibm_is_public_gateway.gateway": {
@@ -543,7 +551,7 @@
543551
},
544552
"pos": {
545553
"filename": "main.tf",
546-
"line": 81
554+
"line": 85
547555
}
548556
},
549557
"ibm_is_security_group_rule.default_vpc_rule": {
@@ -632,7 +640,7 @@
632640
},
633641
"pos": {
634642
"filename": "main.tf",
635-
"line": 46
643+
"line": 50
636644
}
637645
},
638646
"ibm_is_vpc_routing_table_route.routing_table_routes": {
@@ -647,11 +655,24 @@
647655
},
648656
"pos": {
649657
"filename": "main.tf",
650-
"line": 55
658+
"line": 59
659+
}
660+
}
661+
},
662+
"data_resources": {
663+
"data.ibm_is_vpc_address_prefixes.get_address_prefixes": {
664+
"mode": "data",
665+
"type": "ibm_is_vpc_address_prefixes",
666+
"name": "get_address_prefixes",
667+
"provider": {
668+
"name": "ibm"
669+
},
670+
"pos": {
671+
"filename": "main.tf",
672+
"line": 39
651673
}
652674
}
653675
},
654-
"data_resources": {},
655676
"module_calls": {
656677
"dynamic_values": {
657678
"name": "dynamic_values",

‎network_acls.tf‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -47,31 +47,35 @@ locals {
4747
}
4848
]
4949

50-
vpc_connectivity_rules = [
51-
# All connectivity across any subnet within VPC
52-
# TODO: narrow down to VPC address spaces
50+
vpc_inbound_rule = [
51+
for address in data.ibm_is_vpc_address_prefixes.get_address_prefixes.address_prefixes :
5352
{
54-
name = "ibmflow-allow-vpc-connectivity-inbound"
53+
name = "ibmflow-allow-vpc-connectivity-inbound-${substr(address.id, -4, -1)}" # Providing unique rule names
5554
action = "allow"
56-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
55+
source = address.cidr
5756
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
5857
direction = "inbound"
5958
tcp = null
6059
udp = null
6160
icmp = null
62-
},
61+
}
62+
]
63+
vpc_outbound_rule = [
64+
for address in data.ibm_is_vpc_address_prefixes.get_address_prefixes.address_prefixes :
6365
{
64-
name = "ibmflow-allow-vpc-connectivity-outbound"
66+
name = "ibmflow-allow-vpc-connectivity-outbound-${substr(address.name, -4, -1)}"
6567
action = "allow"
6668
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
67-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
69+
destination = address.cidr
6870
direction = "outbound"
6971
tcp = null
7072
udp = null
7173
icmp = null
7274
}
7375
]
7476

77+
vpc_connectivity_rules = distinct(flatten(concat(local.vpc_inbound_rule, local.vpc_outbound_rule)))
78+
7579
deny_all_rules = [
7680
{
7781
name = "ibmflow-deny-all-inbound"

‎outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,3 +134,7 @@ output "vpc_flow_logs" {
134134
}
135135

136136
##############################################################################
137+
output "cidr_blocks" {
138+
description = "List of CIDR blocks present in VPC stack"
139+
value = [for address in data.ibm_is_vpc_address_prefixes.get_address_prefixes.address_prefixes : address.cidr]
140+
}

‎tests/pr_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,18 @@ import (
1010
const defaultExampleTerraformDir = "examples/default"
1111
const resourceGroup = "geretain-test-resources"
1212

13+
// The ACL ignores can be removed once we merge this PR (https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/pull/471)
14+
var ignoreUpdates = []string{"module.slz_vpc.ibm_is_network_acl.network_acl[\"vpc-acl\"]"}
15+
1316
func setupOptions(t *testing.T, prefix string) *testhelper.TestOptions {
1417
options := testhelper.TestOptionsDefaultWithVars(&testhelper.TestOptions{
1518
Testing: t,
1619
TerraformDir: defaultExampleTerraformDir,
1720
Prefix: prefix,
1821
ResourceGroup: resourceGroup,
22+
IgnoreUpdates: testhelper.Exemptions{
23+
List: ignoreUpdates,
24+
},
1925
})
2026

2127
return options

0 commit comments

Comments
 (0)