Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Oasys: INC2742748: ip allow list update #8747

Merged
merged 6 commits into from
Nov 22, 2024
Merged

Oasys: INC2742748: ip allow list update #8747

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
881b7d2
oasys: add additional serco IPs
drobinson-moj Nov 22, 2024
ebc674d
rename cidr allow list for azure landing zone
drobinson-moj Nov 22, 2024
47e14dc
update security groups - add missing serco IPs and tidy up
drobinson-moj Nov 22, 2024
61a76b7
fix
drobinson-moj Nov 22, 2024
db7a73a
Fix
drobinson-moj Nov 22, 2024
90f7d46
fix
drobinson-moj Nov 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion terraform/environments/delius-jitbit/locals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ locals {
module.ip_addresses.moj_cidr.ark_dc_external_internet,
module.ip_addresses.moj_cidr.vodafone_dia_networks,
module.ip_addresses.moj_cidr.palo_alto_primsa_access_corporate,
module.ip_addresses.moj_cidr.digital_prisons,
module.ip_addresses.moj_cidr.mojo_azure_landing_zone_egress,
[
# Route53 Healthcheck Access Cidrs
# London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
Expand Down
35 changes: 20 additions & 15 deletions terraform/environments/oasys/locals_security_groups.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,16 +37,27 @@ locals {
])
ssh = ["10.0.0.0/8"]
https_internal = flatten([
module.ip_addresses.moj_cidr.aws_cloud_platform_vpc,
"10.0.0.0/8",
module.ip_addresses.moj_cidr.aws_cloud_platform_vpc, # "172.20.0.0/16"
])
https_external = flatten([
module.ip_addresses.azure_fixngo_cidrs.internet_egress,
module.ip_addresses.moj_cidrs.trusted_moj_digital_staff_public,
module.ip_addresses.moj_cidr.aws_cloud_platform_vpc, # "172.20.0.0/16"
module.ip_addresses.moj_cidr.vodafone_dia_networks,
module.ip_addresses.moj_cidr.palo_alto_primsa_access_corporate,
module.ip_addresses.external_cidrs.cloud_platform,
module.ip_addresses.azure_studio_hosting_public.prod,
"10.0.0.0/8"
"35.177.125.252/32", "35.177.137.160/32", # infra_ip.j5_phones - probably not needed
module.ip_addresses.external_cidrs.sodeco,
module.ip_addresses.external_cidrs.interserve,
module.ip_addresses.external_cidrs.meganexus,
module.ip_addresses.external_cidrs.serco,
module.ip_addresses.external_cidrs.rrp,
module.ip_addresses.external_cidrs.eos,
module.ip_addresses.external_cidrs.oasys_sscl,
module.ip_addresses.external_cidrs.dtv,
module.ip_addresses.external_cidrs.nps_wales,
module.ip_addresses.external_cidrs.dxw,
])
https_external_monitoring = flatten([
module.ip_addresses.mp_cidrs.live_eu_west_nat,
Expand Down Expand Up @@ -80,14 +91,11 @@ locals {
https_external = flatten([
module.ip_addresses.azure_fixngo_cidrs.internet_egress,
module.ip_addresses.moj_cidrs.trusted_moj_digital_staff_public,
module.ip_addresses.moj_cidr.aws_cloud_platform_vpc, # "172.20.0.0/16"
module.ip_addresses.moj_cidr.vodafone_dia_networks,
module.ip_addresses.moj_cidr.palo_alto_primsa_access_corporate,
module.ip_addresses.external_cidrs.cloud_platform,
module.ip_addresses.azure_studio_hosting_public.prod,
"35.177.125.252/32", "35.177.137.160/32", # trusted_appgw_external_client_ips infra_ip.j5_phones
"20.49.214.199/32", "20.49.214.228/32", "20.26.11.71/32", "20.26.11.108/32", # Azure Landing Zone Egress
"195.59.75.0/24", "194.33.192.0/25", "194.33.193.0/25", "194.33.196.0/25", "194.33.197.0/25", # dom1_eucs_ras
"35.177.125.252/32", "35.177.137.160/32", # infra_ip.j5_phones - probably not needed
module.ip_addresses.external_cidrs.sodeco,
module.ip_addresses.external_cidrs.interserve,
module.ip_addresses.external_cidrs.meganexus,
Expand Down Expand Up @@ -226,14 +234,11 @@ locals {
self = true
}
http8080 = {
description = "Allow http8080 ingress"
from_port = 0
to_port = 8080
protocol = "tcp"
cidr_blocks = flatten([
local.security_group_cidrs.https_internal,
local.security_group_cidrs.https_external,
])
description = "Allow http8080 ingress"
from_port = 0
to_port = 8080
protocol = "tcp"
cidr_blocks = local.security_group_cidrs.https_internal
security_groups = ["private_lb", "public_lb"]
}
}
Expand Down
6 changes: 5 additions & 1 deletion terraform/modules/ip_addresses/external.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,11 @@ locals {
"49.248.250.6/32"
]
serco = [
"217.22.14.0/24"
"217.22.14.0/24",
"18.135.54.44/32",
"18.175.105.241/32",
"35.177.142.157/32",
"128.77.110.45/32",
]
rrp = [
"62.253.83.37/32"
Expand Down
5 changes: 2 additions & 3 deletions terraform/modules/ip_addresses/moj.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ locals {
mojo_arkf_internet_egress_exponential_e = "51.149.249.32/29"
mojo_arkf_internet_egress_vodafone = "194.33.248.0/29"


ark_dc_external_internet = [
"195.59.75.0/24",
"194.33.192.0/25",
Expand All @@ -42,7 +41,7 @@ locals {
"194.33.218.0/24"
]

digital_prisons = [
mojo_azure_landing_zone_egress = [
"20.49.214.199/32",
"20.49.214.228/32",
"20.26.11.71/32",
Expand All @@ -53,7 +52,6 @@ locals {
palo_alto_primsa_access_third_party = "128.77.75.0/25"
palo_alto_primsa_access_residents = "128.77.75.128/26"


ark_dc_external_internet = [
"195.59.75.0/24",
"194.33.192.0/25",
Expand Down Expand Up @@ -92,6 +90,7 @@ locals {
local.moj_cidr.mojo_arkf_internet_egress_exponential_e,
local.moj_cidr.mojo_arkf_internet_egress_vodafone,
local.moj_cidr.ark_dc_external_internet,
local.moj_cidr.mojo_azure_landing_zone_egress
])

trusted_moj_enduser_internal = [
Expand Down
Loading