Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ldap datarefresh nit859 #3668

Merged
merged 21 commits into from
Oct 18, 2023
Merged

Ldap datarefresh nit859 #3668

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
6cd2eb2
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
048d7cc
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
aac5584
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
7939399
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
81bbee2
typo
georgepstaylor Oct 12, 2023
c5ee665
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
4ec7fb9
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
3cc4d45
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
e2eb5cd
Update ldap_datasync.tf
georgepstaylor Oct 12, 2023
b6535ef
Update ldap_datasync.tf
georgepstaylor Oct 16, 2023
4b08c2a
Merge branch 'main' into ldap-datarefresh-NIT859
georgepstaylor Oct 16, 2023
503fceb
replace digital vpn with global protect
Oct 12, 2023
727f4e5
add global protect rules
Oct 16, 2023
b2b4b57
Update ldap_datasync.tf
georgepstaylor Oct 16, 2023
ace8bea
Merge branch 'main' into ldap-datarefresh-NIT859
georgepstaylor Oct 16, 2023
e95d72f
Merge remote-tracking branch 'origin/NIT-887_global_protect' into lda…
georgepstaylor Oct 16, 2023
d2fa474
Update ldap_datasync.tf
georgepstaylor Oct 17, 2023
745e80d
Merge branch 'main' into ldap-datarefresh-NIT859
georgepstaylor Oct 17, 2023
533a387
allow ingress from the vpc
georgepstaylor Oct 17, 2023
6c1518c
kms
georgepstaylor Oct 17, 2023
946e625
rename rule
georgepstaylor Oct 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions terraform/environments/delius-core/modules/environment_all_components/ldap_datasync.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,21 @@ data "aws_iam_policy_document" "ldap_datasync_role_access" {
"backup:*",
"datasync:*",
"elasticfilesystem:*",
"ec2:DescribeInstances",
"ec2:CreateNetworkInterface",
"ec2:AttachNetworkInterface",
"ec2:DescribeNetworkInterfaces",
"ec2:DeleteNetworkInterface",
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:DescribeKey",
"kms:GetPublicKey",
"kms:ReEncrypt*",
"kms:GenerateDataKey",
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
]
resources = ["*"]
}
Expand All @@ -60,8 +75,8 @@ data "aws_iam_policy_document" "ldap_datasync_role_access" {
effect = "Allow"
actions = ["s3:*"]
resources = [
"${module.s3_bucket_ldap_data_refresh.bucket.arn}",
"${module.s3_bucket_ldap_data_refresh.bucket.arn}/*",
"arn:aws:s3:::*-ldap-data-refresh-incoming",
"arn:aws:s3:::*-ldap-data-refresh-incoming/*",
]
}
}
Expand Down
9 changes: 9 additions & 0 deletions terraform/environments/delius-core/modules/environment_all_components/ldap_efs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,15 @@ resource "aws_security_group_rule" "efs_ingress" {
security_group_id = aws_security_group.ldap_efs.id
}

resource "aws_security_group_rule" "efs_ingress_vpc" {
type = "ingress"
from_port = 2049
to_port = 2049
protocol = "tcp"
cidr_blocks = [var.account_config.shared_vpc_cidr]
security_group_id = aws_security_group.ldap_efs.id
}

resource "aws_security_group_rule" "efs_egress" {
type = "egress"
from_port = 0
Expand Down
18 changes: 18 additions & 0 deletions terraform/environments/delius-core/modules/environment_all_components/weblogic_alb.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,24 @@ resource "aws_vpc_security_group_ingress_rule" "delius_core_frontend_alb_ingress
cidr_ipv4 = "81.134.202.29/32" # MoJ Digital VPN
}

resource "aws_vpc_security_group_ingress_rule" "delius_core_frontend_alb_ingress_https_allowlist_gp" {
security_group_id = aws_security_group.delius_frontend_alb_security_group.id
description = "access into delius core frontend alb over https"
from_port = "443"
to_port = "443"
ip_protocol = "tcp"
cidr_ipv4 = "35.176.93.186/32" # Global Protect VPN
}

resource "aws_vpc_security_group_ingress_rule" "delius_core_frontend_alb_ingress_http_allowlist_gp" {
security_group_id = aws_security_group.delius_frontend_alb_security_group.id
description = "access into delius core frontend alb over http (will redirect)"
from_port = "80"
to_port = "80"
ip_protocol = "tcp"
cidr_ipv4 = "35.176.93.186/32" # Global Protect VPN
}

resource "aws_vpc_security_group_egress_rule" "delius_core_frontend_alb_egress_to_service" {
security_group_id = aws_security_group.delius_frontend_alb_security_group.id
description = "access delius core frontend service from alb"
Expand Down
1 change: 1 addition & 0 deletions terraform/environments/delius-jitbit/lb.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ resource "aws_security_group" "load_balancer_security_group" {
to_port = 443
cidr_blocks = [
"81.134.202.29/32", # MoJ Digital VPN
"35.176.93.186/32", # Global Protect VPN
"217.33.148.210/32", # Digital studio
"195.59.75.0/24", # ARK internet (DOM1)
"194.33.192.0/25", # ARK internet (DOM1)
Expand Down
Loading