1210137 - restrict outbound flows from AWS

Status: RESOLVED WONTFIX

(Infrastructure & Operations :: RelOps: General, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Right now, all of our AWS security groups allow anything outbound.

Now that we've written a full set of tests for outbound access, we can confidently start to write some SG rules for outbound access, too.

..and once that's done, we can pretty easily fix up the routing tables to send everything not destined to 10.0.0.0/8 out the IGW, confident that we're not losing any filtering.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/mozilla/build-cloud-tools/pull/121

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Applied to
  tst-emulator64-spot-302
  bld-linux64-spot-385
  bld-linux64-spot-389
  try-linux64-spot-409
  try-linux64-spot-301

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

  tst-linux32-spot-301
  tst-linux32-spot-303
  tst-linux32-spot-305

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

OK, spotted one thing: stage.mozilla.org isn't accessible.  I've added the Mozilla public IP space.

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

With that change, things are looking pretty good.

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/mozilla/build-cloud-tools/pull/123

Still to do: all the other VLANs (masters, nagios, etc.).  At least those aren't spot instances, so we can statically switch a few hosts over at a time to the new groups and look for problems.  Also, they have far fewer outgoing flows!

Comment 7

[Dustin J. Mitchell [:dustin] (he/him)]

I landed that just for test so far -- I'll loop back shortly and land for try/build.

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Landed for build/try now, too.

Comment 9

[Dustin J. Mitchell [:dustin] (he/him)]

So the remaining bit here is to change all of the other security groups over.  They are all for servers, so it's a bit easier to "test" one or two instances since they can just be reassigned in the UI without hoping the spot instance lives on.  All of the required flows are in https://mana.mozilla.org/wiki/pages/viewpage.action?pageId=43723701

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

I'm disinclined to finish this -- it's a fair bit of fairly risky work, although nothing too bad, but ultimately nothing is driving it.  Anyone is free to reopen and take care of this if it becomes useful.