Skip to content

Commit

Permalink
CDPCAM-71 Add Private Subnets validation with 'Auto-assign public IPs…
Browse files Browse the repository at this point in the history 
…' disabled (#22)

* Add private subnets auto-assign IP settings validation

Signed-off-by: Anurag Patro <[email protected]>
  • Loading branch information
@anuragpatro
anuragpatro authored Aug 24, 2021
1 parent 4f195dd commit e7a0089
Show file tree
Hide file tree
Showing 4 changed files with 90 additions and 1 deletion.
4 changes: 4 additions & 0 deletions cdpctl/validation/infra/issue_templates.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -165,3 +165,7 @@ docs_link: https://docs.cloudera.com/cdp/latest/requirements-aws/topics/mc-aws-r
id: AWS_VPC_NOT_FOUND_IN_ACCOUNT
summary: "VPC ID {0} set in infra:aws:vpc:existing:vpc_id was not found in the AWS account."
docs_link: https://docs.cloudera.com/cdp/latest/requirements-aws/topics/mc-aws-req-vpc.html
---
id: AWS_SUBNETS_WITH_PUBLIC_IPS_ENABLED
summary: "These {0} Subnets must have 'Auto-assign Public IPs' disabled for a fully-private network configuration."
render_type: list
2 changes: 2 additions & 0 deletions cdpctl/validation/infra/issues.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -121,3 +121,5 @@
AWS_DNS_SUPPORT_NOT_ENABLED_FOR_VPC = "AWS_DNS_SUPPORT_NOT_ENABLED_FOR_VPC"

AWS_VPC_NOT_FOUND_IN_ACCOUNT = "AWS_VPC_NOT_FOUND_IN_ACCOUNT"

AWS_SUBNETS_WITH_PUBLIC_IPS_ENABLED = "AWS_SUBNETS_WITH_PUBLIC_IPS_ENABLED"
22 changes: 22 additions & 0 deletions cdpctl/validation/infra/validate_aws_subnets.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@
AWS_SUBNETS_MISSING_K8S_LB_TAG,
AWS_SUBNETS_NOT_PART_OF_VPC,
AWS_SUBNETS_OR_VPC_WITHOUT_INTERNET_GATEWAY,
AWS_SUBNETS_WITH_PUBLIC_IPS_ENABLED,
AWS_SUBNETS_WITHOUT_INTERNET_GATEWAY,
AWS_SUBNETS_WITHOUT_VALID_RANGE,
)
Expand Down Expand Up @@ -414,6 +415,27 @@ def aws_private_subnets_tags_validation() -> None:
fail(AWS_REQUIRED_DATA_MISSING, e.args[0])


@pytest.mark.aws
@pytest.mark.infra
@pytest.mark.dependency(depends=["aws_private_subnets_validation"])
def aws_private_subnets_auto_assign_ip_validation() -> None:
"""Private subnets have auto-assign public IPs disabled.""" # noqa: D401,E501
try:
subnets_w_public_ips_enabled = []
for subnet in subnets_data["private_subnets"]:
if subnet["MapPublicIpOnLaunch"]:
subnets_w_public_ips_enabled.append(subnet["SubnetId"])

if len(subnets_w_public_ips_enabled) > 0:
warn(
AWS_SUBNETS_WITH_PUBLIC_IPS_ENABLED,
subjects=["Private"],
resources=subnets_w_public_ips_enabled,
)
except KeyError as e:
fail(AWS_REQUIRED_DATA_MISSING, e.args[0])


@pytest.mark.aws
@pytest.mark.infra
@pytest.mark.dependency(
Expand Down
63 changes: 62 additions & 1 deletion tests/validation/infra/test_validate_aws_subnets.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@

from cdpctl.validation.aws_utils import get_client
from cdpctl.validation.infra.validate_aws_subnets import (
aws_private_subnets_auto_assign_ip_validation,
aws_private_subnets_availablity_zone_validation,
aws_private_subnets_range_validation,
aws_private_subnets_route_validation,
Expand Down Expand Up @@ -107,6 +108,7 @@
{
"AvailabilityZone": "us-west-2b",
"CidrBlock": "20.0.237.0/14",
"MapPublicIpOnLaunch": False,
"SubnetId": "subnet-prvtest1-cdp",
"VpcId": "vpc-testcdp12345",
"Tags": [
Expand All @@ -117,6 +119,7 @@
{
"AvailabilityZone": "us-west-2c",
"CidrBlock": "20.1.238.0/19",
"MapPublicIpOnLaunch": False,
"SubnetId": "subnet-prvtest2-cdp",
"VpcId": "vpc-testcdp12345",
"Tags": [
Expand All @@ -127,6 +130,7 @@
{
"AvailabilityZone": "us-west-2a",
"CidrBlock": "20.2.236.0/18",
"MapPublicIpOnLaunch": False,
"SubnetId": "subnet-prvtest3-cdp",
"VpcId": "vpc-testcdp12345",
"Tags": [
Expand Down Expand Up @@ -899,7 +903,7 @@ def test_aws_private_subnets_tags_validation_success(ec2_client: EC2Client) -> N
func()


def test_aws_private_subnets_tags_validation_failure(ec2_client: EC2Client) -> None:
def test_aws_private_subnets_tags_validation_warning(ec2_client: EC2Client) -> None:
"""Unit test private subnets tags failure."""
config = get_config(
private_subnet_ids_val=private_subnet_ids, private_suffix_val="fail"
Expand Down Expand Up @@ -941,6 +945,63 @@ def test_aws_private_subnets_tags_validation_failure(ec2_client: EC2Client) -> N
func()


def test_aws_private_subnets_auto_assign_ip_validation_success(
ec2_client: EC2Client,
) -> None:
"""Unit test private subnets auto assign ip settings success."""
config = get_config(
private_subnet_ids_val=private_subnet_ids, private_suffix_val="cdp"
)
stubber = Stubber(ec2_client)
stubber.add_response(
"describe_subnets",
sample_private_subnets_response,
expected_params={"SubnetIds": private_subnet_ids},
)
with stubber:
func = expect_validation_success(aws_private_subnets_validation)
func(config, ec2_client)
with stubber:
func = expect_validation_success(aws_private_subnets_auto_assign_ip_validation)
func()


def test_aws_private_subnets_auto_assign_ip_validation_warning(
ec2_client: EC2Client,
) -> None:
"""Unit test private subnets auto assign ip settings failure."""
config = get_config(
private_subnet_ids_val=private_subnet_ids, private_suffix_val="fail"
)
stubber = Stubber(ec2_client)
stubber.add_response(
"describe_subnets",
{
"Subnets": [
{
"MapPublicIpOnLaunch": False,
"SubnetId": "subnet-prvtest1-cdp",
},
{
"MapPublicIpOnLaunch": False,
"SubnetId": "subnet-prvtest2-cdp",
},
{
"MapPublicIpOnLaunch": True,
"SubnetId": "subnet-prvtest3-cdp",
},
],
},
expected_params={"SubnetIds": private_subnet_ids},
)
with stubber:
func = expect_validation_success(aws_private_subnets_validation)
func(config, ec2_client)
with stubber:
func = expect_validation_warning(aws_private_subnets_auto_assign_ip_validation)
func()


def test_aws_vpc_validation_success(ec2_client: EC2Client) -> None:
"""Unit test vpc success."""
config = {
Expand Down

0 comments on commit e7a0089

Please sign in to comment.