Restrict ALB integration-test security group to the test runner's IP - #2532
Open
GarrettBeatty wants to merge 1 commit into
Open
Restrict ALB integration-test security group to the test runner's IP#2532GarrettBeatty wants to merge 1 commit into
GarrettBeatty wants to merge 1 commit into
Conversation
The ALB integration test provisioned an internet-facing ALB with a security group open to 0.0.0.0/0 on port 80 and no authentication. DyePack's EC2IPAuthentication scanner flags this publicly accessible endpoint, which has required a standing AppSec exception for the test accounts. Add an AllowedCidr template parameter (no default, fails closed) and point the security group ingress at it. DeploymentScript.ps1 resolves the runner's public egress IP and passes it as AllowedCidr=<ip>/32, so the ALB stays reachable by the test client but not by DyePack's scanners. The ALB remains internet-facing so the existing test, which calls the public DNS from outside the VPC, is unchanged.
GarrettBeatty
added
the
Release Not Needed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
TestServerlessApp.ALBintegration test provisions an internet-facing ALB whose security group is open to0.0.0.0/0on port 80 with no authentication. DyePack'sEC2IPAuthenticationscanner flags this publicly accessible endpoint, which has required a standing AppSec exception for the test accounts.This change closes the exposure at the source instead of relying on the exception.
Changes
TestServerlessApp.ALB/serverless.templateAllowedCidrparameter (IPv4-CIDR validated, no default so a deploy without it fails closed rather than opening the ALB to the internet).{ "Ref": "AllowedCidr" }instead of0.0.0.0/0.TestServerlessApp.ALB.IntegrationTests/DeploymentScript.ps1checkip.amazonaws.com, with retries + validation) and pass--template-parameters "AllowedCidr=<ip>/32". Throws if it can't get a valid IP.The ALB remains
internet-facing, so the existing test — which calls the ALB's public DNS from outside the VPC — is unchanged. Locking ingress to the runner's/32means the ALB is reachable by the test client but not by DyePack's scanners, so the finding should no longer fire.Notes
.autoverchange file.checkip(single host / NAT with one EIP, e.g. VPC-attached CodeBuild). On a network with an egress IP pool, the/32could occasionally miss; widen to the runner's NAT CIDR if that occurs in CI.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.