1139668 - Allow access to internal KMS for AWS releng vpcs

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Q]

Need VPC access from these zones
VPC us-west-1	releng.usw1	10.130.0.0/16		 
VPC us-west-2	releng.usw2	10.132.0.0/16		 
VPC us-east-1	releng.use1	10.134.0.0/16

to kms1.ad.mozilla.com 10.22.69.24
on tcp port 1688

Comment 1

[James Barnell [:jbarnell]]

FW1.SCL3:

{primary:node0}[edit]
[e-mail]# show | compare 
[edit security policies from-zone dc to-zone db]
      policy ldapmaster1--ldap { ... }
+     policy kms {
+         match {
+             source-address [ us-west-1.releng us-west-2.releng us-east-1.releng ];
+             destination-address kms1.ad;
+             application kms;
+         }
+         then {
+             permit;
+         }
+     }


This is complete there is no need to add policies to FW1.RELENG.SCL3 as there is an existing permit all from the VPC to the DC.

Please test and confirm

Comment 2

[John B [:johnb]]

nuked in bug 1162352

re-added per request:
[e-mail]# show | compare 
[edit security policies from-zone dc to-zone db]
      policy bug-1204792--mysql { ... }
+     policy bug-1139668-kms {
+         match {
+             source-address [ us-west-1.releng us-west-2.releng us-east-1.releng ];
+             destination-address kms1.ad.db.scl3;
+             application kms;
+         }
+         then {
+             permit;
+         }
+     }