Skip to content

Commit f11a0a9

Browse files
jor2jor2
authored
fix: removed the opening of 0.0.0.0/0 in the default value for network acls rules (#424)
BREAKING CHANGE: If you were consuming the module using the default value for var.network_acls and upgraded to this version, the `allow-all-443-inbound` and `allow-all-443-outbound` ACL rules will be removed since opening 0.0.0.0/0 is not FsCloud compliant.
1 parent 06a279b commit f11a0a9

File tree

5 files changed

+83
-56
lines changed

5 files changed

+83
-56
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,6 @@ jobs:
1515
call-terraform-ci-pipeline:
1616
uses: terraform-ibm-modules/common-pipeline-assets/.github/workflows/[email protected]
1717
secrets: inherit
18+
with:
19+
craTarget: "examples/default"
20+
craGoalIgnoreFile: "cra-tf-validate-ignore-goals.json"

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ You need the following permissions to run this module.
111111
| <a name="input_existing_storage_bucket_name"></a> [existing\_storage\_bucket\_name](#input\_existing\_storage\_bucket\_name) | Name of the COS bucket to collect VPC flow logs | `string` | `null` | no |
112112
| <a name="input_is_flow_log_collector_active"></a> [is\_flow\_log\_collector\_active](#input\_is\_flow\_log\_collector\_active) | Indicates whether the collector is active. If false, this collector is created in inactive mode. | `bool` | `true` | no |
113113
| <a name="input_name"></a> [name](#input\_name) | Name for VPC | `string` | n/a | yes |
114-
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | List of ACLs to create. Rules can be automatically created to allow inbound and outbound traffic from a VPC tier by adding the name of that tier to the `network_connections` list. Rules automatically generated by these network connections will be added at the beginning of a list, and will be web-tierlied to traffic first. At least one rule must be provided for each ACL. | <pre>list(<br> object({<br> name = string<br> network_connections = optional(list(string))<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_ibm_cloud_internal_rules": true,<br> "add_vpc_connectivity_rules": true,<br> "name": "vpc-acl",<br> "prepend_ibm_rules": true,<br> "rules": [<br> {<br> "action": "allow",<br> "destination": "0.0.0.0/0",<br> "direction": "inbound",<br> "name": "allow-all-443-inbound",<br> "source": "0.0.0.0/0",<br> "tcp": {<br> "port_max": 443,<br> "port_min": 443<br> }<br> },<br> {<br> "action": "allow",<br> "destination": "0.0.0.0/0",<br> "direction": "outbound",<br> "name": "allow-all-443-outbound",<br> "source": "0.0.0.0/0",<br> "tcp": {<br> "source_port_max": 443,<br> "source_port_min": 443<br> }<br> }<br> ]<br> }<br>]</pre> | no |
114+
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | List of ACLs to create. Rules can be automatically created to allow inbound and outbound traffic from a VPC tier by adding the name of that tier to the `network_connections` list. Rules automatically generated by these network connections will be added at the beginning of a list, and will be web-tierlied to traffic first. At least one rule must be provided for each ACL. | <pre>list(<br> object({<br> name = string<br> network_connections = optional(list(string))<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_ibm_cloud_internal_rules": true,<br> "add_vpc_connectivity_rules": true,<br> "name": "vpc-acl",<br> "prepend_ibm_rules": true,<br> "rules": []<br> }<br>]</pre> | no |
115115
| <a name="input_network_cidr"></a> [network\_cidr](#input\_network\_cidr) | Network CIDR for the VPC. This is used to manage network ACL rules for cluster provisioning. | `string` | `"10.0.0.0/8"` | no |
116116
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix that you would like to append to your resources | `string` | n/a | yes |
117117
| <a name="input_region"></a> [region](#input\_region) | The region to which to deploy the VPC | `string` | n/a | yes |

‎cra-tf-validate-ignore-goals.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"scc_goals": [
3+
{
4+
"scc_goal_id": "3000102",
5+
"description:": "Check whether Cloud Object Storage is enabled with customer-managed encryption and Bring Your Own Key (BYOK)",
6+
"ignore_reason": "This module does not create any Cloud object storage and it is used in an example for testing purpose.",
7+
"is_valid": false
8+
},
9+
{
10+
"scc_goal_id": "3000107",
11+
"description:": "Check whether Cloud Object Storage network access is restricted to a specific IP range",
12+
"ignore_reason": "This module does not create any Cloud object storage and it is used in an example for testing purpose.",
13+
"is_valid": false
14+
},
15+
{
16+
"scc_goal_id": "3000108",
17+
"description:": "Check whether Cloud Object Storage is enabled with customer-managed encryption and Keep Your Own Key (KYOK)",
18+
"ignore_reason": "This module does not create any Cloud object storage and it is used in an example for testing purpose.",
19+
"is_valid": false
20+
},
21+
{
22+
"scc_goal_id": "3000114",
23+
"description:": "Check whether Cloud Object Storage buckets are enabled with IBM Activity Tracker",
24+
"ignore_reason": "This module does not create any Cloud object storage bucket and it is used in an example for testing purpose.",
25+
"is_valid": false
26+
},
27+
{
28+
"scc_goal_id": "3000115",
29+
"description:": "Check whether Cloud Object Storage buckets are enabled with IBM Cloud Monitoring",
30+
"ignore_reason": "This module does not create any Cloud object storage bucket and it is used in an example for testing purpose.",
31+
"is_valid": false
32+
},
33+
{
34+
"scc_goal_id": "3000116",
35+
"description:": "Check whether Cloud Object Storage bucket resiliency is set to cross region",
36+
"ignore_reason": "This module does not create any Cloud object storage bucket and it is used in an example for testing purpose.",
37+
"is_valid": false
38+
}
39+
]
40+
}

‎module-metadata.json‎

Lines changed: 10 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"default": false,
4040
"pos": {
4141
"filename": "variables.tf",
42-
"line": 408
42+
"line": 415
4343
}
4444
},
4545
"default_network_acl_name": {
@@ -101,7 +101,7 @@
101101
],
102102
"pos": {
103103
"filename": "variables.tf",
104-
"line": 402
104+
"line": 409
105105
}
106106
},
107107
"existing_cos_instance_guid": {
@@ -113,7 +113,7 @@
113113
],
114114
"pos": {
115115
"filename": "variables.tf",
116-
"line": 414
116+
"line": 421
117117
},
118118
"immutable": true,
119119
"computed": true
@@ -128,7 +128,7 @@
128128
],
129129
"pos": {
130130
"filename": "variables.tf",
131-
"line": 420
131+
"line": 427
132132
},
133133
"immutable": true
134134
},
@@ -142,7 +142,7 @@
142142
],
143143
"pos": {
144144
"filename": "variables.tf",
145-
"line": 426
145+
"line": 433
146146
}
147147
},
148148
"name": {
@@ -165,30 +165,7 @@
165165
"add_vpc_connectivity_rules": true,
166166
"name": "vpc-acl",
167167
"prepend_ibm_rules": true,
168-
"rules": [
169-
{
170-
"action": "allow",
171-
"destination": "0.0.0.0/0",
172-
"direction": "inbound",
173-
"name": "allow-all-443-inbound",
174-
"source": "0.0.0.0/0",
175-
"tcp": {
176-
"port_max": 443,
177-
"port_min": 443
178-
}
179-
},
180-
{
181-
"action": "allow",
182-
"destination": "0.0.0.0/0",
183-
"direction": "outbound",
184-
"name": "allow-all-443-outbound",
185-
"source": "0.0.0.0/0",
186-
"tcp": {
187-
"source_port_max": 443,
188-
"source_port_min": 443
189-
}
190-
}
191-
]
168+
"rules": []
192169
}
193170
],
194171
"source": [
@@ -279,7 +256,7 @@
279256
],
280257
"pos": {
281258
"filename": "variables.tf",
282-
"line": 374
259+
"line": 381
283260
}
284261
},
285262
"security_group_rules": {
@@ -298,7 +275,7 @@
298275
],
299276
"pos": {
300277
"filename": "variables.tf",
301-
"line": 308
278+
"line": 315
302279
}
303280
},
304281
"subnets": {
@@ -336,7 +313,7 @@
336313
],
337314
"pos": {
338315
"filename": "variables.tf",
339-
"line": 245
316+
"line": 252
340317
}
341318
},
342319
"tags": {
@@ -390,7 +367,7 @@
390367
],
391368
"pos": {
392369
"filename": "variables.tf",
393-
"line": 219
370+
"line": 226
394371
}
395372
}
396373
},

‎variables.tf‎

Lines changed: 29 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -145,28 +145,35 @@ variable "network_acls" {
145145
add_vpc_connectivity_rules = true
146146
prepend_ibm_rules = true
147147
rules = [
148-
{
149-
name = "allow-all-443-inbound"
150-
action = "allow"
151-
direction = "inbound"
152-
tcp = {
153-
port_min = 443
154-
port_max = 443
155-
}
156-
destination = "0.0.0.0/0"
157-
source = "0.0.0.0/0"
158-
},
159-
{
160-
name = "allow-all-443-outbound"
161-
action = "allow"
162-
direction = "outbound"
163-
tcp = {
164-
source_port_min = 443
165-
source_port_max = 443
166-
}
167-
destination = "0.0.0.0/0"
168-
source = "0.0.0.0/0"
169-
}
148+
## The below rules may be added to easily provide network connectivity for a loadbalancer
149+
## Note that opening 0.0.0.0/0 is not FsCloud compliant
150+
# {
151+
# name = "allow-all-443-inbound"
152+
# action = "allow"
153+
# direction = "inbound"
154+
# tcp = {
155+
156+
# port_min = 443
157+
# port_max = 443
158+
# source_port_min = 1024
159+
# source_port_max = 65535
160+
# }
161+
# destination = "0.0.0.0/0"
162+
# source = "0.0.0.0/0"
163+
# },
164+
# {
165+
# name = "allow-all-443-outbound"
166+
# action = "allow"
167+
# direction = "outbound"
168+
# tcp = {
169+
# source_port_min = 443
170+
# source_port_max = 443
171+
# port_min = 1024
172+
# port_max = 65535
173+
# }
174+
# destination = "0.0.0.0/0"
175+
# source = "0.0.0.0/0"
176+
# }
170177
]
171178
}
172179
]

0 commit comments

Comments
 (0)