Skip to content

Commit 3695775

Browse files
author
Christopher M. Neill
committed
automate all the SGs (only a few more to go..)
1 parent bc94074 commit 3695775

1 file changed

Lines changed: 330 additions & 0 deletions

File tree

  • ansible/roles/ec2/sg_configure/tasks

‎ansible/roles/ec2/sg_configure/tasks/main.yml‎

Lines changed: 330 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,176 @@
8484
to_port: -1
8585
group_id: "{{ sg_api }}"
8686

87+
- name: Docker Container Service SG
88+
tags:
89+
- dock
90+
ec2_group:
91+
name: "{{ env }}-dock"
92+
description: "{{ env }} Dock Security Policy"
93+
vpc_id: "{{ vpc_id }}"
94+
region: us-west-2
95+
aws_secret_key: "{{ aws_secret_key }}"
96+
aws_access_key: "{{ aws_access_key }}"
97+
rules:
98+
- proto: tcp
99+
from_port: 22
100+
to_port: 22
101+
group_id: "{{ sg_bastion }}"
102+
- proto: udp
103+
from_port: 53
104+
to_port: 53
105+
group_id: "{{ sg_dock }}"
106+
- proto: tcp
107+
from_port: 53
108+
to_port: 53
109+
group_id: "{{ sg_dock }}"
110+
- proto: tcp
111+
from_port: 3100
112+
to_port: 3100
113+
group_id: "{{ sg_api }}"
114+
- proto: tcp
115+
from_port: 3112
116+
to_port: 3112
117+
group_id: "{{ sg_api }}"
118+
- proto: tcp
119+
from_port: 3200
120+
to_port: 3200
121+
group_id: "{{ sg_api }}"
122+
- proto: tcp
123+
from_port: 4242
124+
to_port: 4242
125+
group_id: "{{ sg_api }}"
126+
- proto: tcp
127+
from_port: 4242
128+
to_port: 4242
129+
group_id: "{{ sg_services }}"
130+
- proto: udp
131+
from_port: 6783
132+
to_port: 6783
133+
group_id: "{{ sg_api }}"
134+
- proto: udp
135+
from_port: 6783
136+
to_port: 6783
137+
group_id: "{{ sg_dock }}"
138+
- proto: tcp
139+
from_port: 6783
140+
to_port: 6783
141+
group_id: "{{ sg_api }}"
142+
- proto: tcp
143+
from_port: 6783
144+
to_port: 6783
145+
group_id: "{{ sg_dock }}"
146+
- proto: tcp
147+
from_port: 8200
148+
to_port: 8200
149+
group_id: "{{ sg_dock }}"
150+
- proto: tcp
151+
from_port: 8200
152+
to_port: 8200
153+
group_id: "{{ sg_services }}"
154+
- proto: tcp
155+
from_port: 32768
156+
to_port: 65535
157+
group_id: "{{ sg_api }}"
158+
- proto: tcp
159+
from_port: 32768
160+
to_port: 65535
161+
group_id: "{{ sg_dock }}"
162+
- proto: tcp
163+
from_port: 32768
164+
to_port: 65535
165+
group_id: "{{ sg_hipache }}"
166+
- proto: tcp
167+
from_port: 32768
168+
to_port: 65535
169+
group_id: "{{ sg_navi }}"
170+
- proto: tcp
171+
from_port: 32768
172+
to_port: 65535
173+
group_id: "{{ sg_redis }}"
174+
- proto: tcp
175+
from_port: 32768
176+
to_port: 65535
177+
group_id: "{{ sg_services }}"
178+
rules_egress:
179+
- proto: all
180+
from_port: -1
181+
to_port: -1
182+
group_id: "{{ sg_dock }}"
183+
184+
- name: Hipache SG
185+
tags:
186+
- hipache
187+
ec2_group:
188+
name: "{{ env }}-hipache"
189+
description: "{{ env }} Hipache Security Policy"
190+
vpc_id: "{{ vpc_id }}"
191+
region: us-west-2
192+
aws_secret_key: "{{ aws_secret_key }}"
193+
aws_access_key: "{{ aws_access_key }}"
194+
rules:
195+
- proto: icmp
196+
from_port: -1
197+
to_port: -1
198+
cidr_ip: 0.0.0.0/0
199+
- proto: tcp
200+
from_port: 22
201+
to_port: 22
202+
group_id: "{{ sg_bastion }}"
203+
- proto: tcp
204+
from_port: 80
205+
to_port: 80
206+
cidr_ip: 0.0.0.0/0
207+
- proto: tcp
208+
from_port: 443
209+
to_port: 443
210+
cidr_ip: 0.0.0.0/0
211+
- proto: tcp
212+
from_port: 3000
213+
to_port: 3000
214+
group_id: "{{ sg_hipache }}"
215+
- proto: tcp
216+
from_port: 8301
217+
to_port: 8301
218+
group_id: "{{ sg_api }}"
219+
- proto: tcp
220+
from_port: 8301
221+
to_port: 8301
222+
group_id: "{{ sg_hipache }}"
223+
- proto: tcp
224+
from_port: 8301
225+
to_port: 8301
226+
group_id: "{{ sg_services }}"
227+
- proto: tcp
228+
from_port: 32768
229+
to_port: 65535
230+
group_id: "{{ sg_api }}"
231+
- proto: tcp
232+
from_port: 32768
233+
to_port: 65535
234+
group_id: "{{ sg_dock }}"
235+
- proto: tcp
236+
from_port: 32768
237+
to_port: 65535
238+
group_id: "{{ sg_hipache }}"
239+
- proto: tcp
240+
from_port: 32768
241+
to_port: 65535
242+
group_id: "{{ sg_redis }}"
243+
- proto: tcp
244+
from_port: 32768
245+
to_port: 65535
246+
group_id: "{{ sg_services }}"
247+
- proto: tcp
248+
from_port: 32768
249+
to_port: 65535
250+
group_id: "{{ sg_web }}"
251+
rules_egress:
252+
- proto: all
253+
from_port: -1
254+
to_port: -1
255+
group_id: "{{ sg_hipache }}"
256+
87257
- name: MongoDB SG
88258
tags:
89259
- mongo
@@ -124,3 +294,163 @@
124294
from_port: -1
125295
to_port: -1
126296
group_id: "{{ sg_mongo }}"
297+
298+
- name: Navi SG
299+
tags:
300+
- navi
301+
ec2_group:
302+
name: "{{ env }}-navi"
303+
description: "{{ env }} Navi Security Policy"
304+
vpc_id: "{{ vpc_id }}"
305+
region: us-west-2
306+
aws_secret_key: "{{ aws_secret_key }}"
307+
aws_access_key: "{{ aws_access_key }}"
308+
rules:
309+
- proto: tcp
310+
from_port: 22
311+
to_port: 22
312+
group_id: "{{ sg_bastion }}"
313+
- proto: tcp
314+
from_port: 3567
315+
to_port: 3567
316+
group_id: "{{ sg_hipache }}"
317+
rules_egress:
318+
- proto: all
319+
from_port: -1
320+
to_port: -1
321+
group_id: "{{ sg_navi }}"
322+
323+
- name: Neo4J SG
324+
tags:
325+
- neo4j
326+
ec2_group:
327+
name: "{{ env }}-neo4j"
328+
description: "{{ env }} Neo4J Security Policy"
329+
vpc_id: "{{ vpc_id }}"
330+
region: us-west-2
331+
aws_secret_key: "{{ aws_secret_key }}"
332+
aws_access_key: "{{ aws_access_key }}"
333+
rules:
334+
- proto: tcp
335+
from_port: 22
336+
to_port: 22
337+
group_id: "{{ sg_bastion }}"
338+
- proto: tcp
339+
from_port: 7473
340+
to_port: 7474
341+
group_id: "{{ sg_api }}"
342+
- proto: tcp
343+
from_port: 7473
344+
to_port: 7474
345+
group_id: "{{ sg_services }}"
346+
rules_egress:
347+
- proto: all
348+
from_port: -1
349+
to_port: -1
350+
group_id: "{{ sg_neo4j }}"
351+
352+
- name: RabbitMQ SG
353+
tags:
354+
- rabbit
355+
ec2_group:
356+
name: "{{ env }}-rabbit"
357+
description: "{{ env }} RabbitMQ Security Policy"
358+
vpc_id: "{{ vpc_id }}"
359+
region: us-west-2
360+
aws_secret_key: "{{ aws_secret_key }}"
361+
aws_access_key: "{{ aws_access_key }}"
362+
rules:
363+
- proto: tcp
364+
from_port: 22
365+
to_port: 22
366+
group_id: "{{ sg_bastion }}"
367+
- proto: tcp
368+
from_port: 54320
369+
to_port: 54321
370+
group_id: "{{ sg_api }}"
371+
- proto: tcp
372+
from_port: 54320
373+
to_port: 54321
374+
group_id: "{{ sg_dock }}"
375+
- proto: tcp
376+
from_port: 54320
377+
to_port: 54321
378+
group_id: "{{ sg_navi }}"
379+
- proto: tcp
380+
from_port: 54320
381+
to_port: 54321
382+
group_id: "{{ sg_services }}"
383+
rules_egress:
384+
- proto: all
385+
from_port: -1
386+
to_port: -1
387+
group_id: "{{ sg_rabbit }}"
388+
389+
- name: RDS SG
390+
tags:
391+
- rds
392+
ec2_group:
393+
name: "{{ env }}-rds"
394+
description: "{{ env }} RDS Security Policy"
395+
vpc_id: "{{ vpc_id }}"
396+
region: us-west-2
397+
aws_secret_key: "{{ aws_secret_key }}"
398+
aws_access_key: "{{ aws_access_key }}"
399+
rules:
400+
- proto: tcp
401+
from_port: 22
402+
to_port: 22
403+
group_id: "{{ sg_bastion }}"
404+
to_port: 5432
405+
group_id: "{{ sg_services }}"
406+
rules_egress:
407+
- proto: all
408+
from_port: -1
409+
to_port: -1
410+
group_id: "{{ sg_rds }}"
411+
412+
- name: Redis SG
413+
tags:
414+
- redis
415+
ec2_group:
416+
name: "{{ env }}-redis"
417+
description: "{{ env }} Redis Security Policy"
418+
vpc_id: "{{ vpc_id }}"
419+
region: us-west-2
420+
aws_secret_key: "{{ aws_secret_key }}"
421+
aws_access_key: "{{ aws_access_key }}"
422+
rules:
423+
- proto: tcp
424+
from_port: 22
425+
to_port: 22
426+
group_id: "{{ sg_bastion }}"
427+
- proto: tcp
428+
from_port: 6379
429+
to_port: 6379
430+
group_id: "{{ sg_api }}"
431+
- proto: tcp
432+
from_port: 6379
433+
to_port: 6379
434+
group_id: "{{ sg_dock }}"
435+
- proto: tcp
436+
from_port: 6379
437+
to_port: 6379
438+
group_id: "{{ sg_hipache }}"
439+
- proto: tcp
440+
from_port: 6379
441+
to_port: 6379
442+
group_id: "{{ sg_navi }}"
443+
- proto: tcp
444+
from_port: 6379
445+
to_port: 6379
446+
group_id: "{{ sg_services }}"
447+
- proto: tcp
448+
from_port: 6379
449+
to_port: 6379
450+
group_id: "{{ sg_web }}"
451+
rules_egress:
452+
- proto: all
453+
from_port: -1
454+
to_port: -1
455+
group_id: "{{ sg_redis }}"
456+

0 commit comments

Comments
 (0)