AWS firewall configuration via security groups

[ShishirPatil]

Adds firewalls

Fixes #272

[parasj]

Follow up from today's meeting: we should reuse the same VPC + SG and not clear it (except in skylark deprovision). ReplicatorClient should remove instance IPs from the security groups FIRST then terminate instances.

[ShishirPatil]

@parasj Can you list out the exact scenario you are thinking for which this would be useful? I can then reason about the best way to handle it.

[parasj]

@ShishirPatil Setup:

• If SG does not exist, create a new Skylark SG. If a VPC does not exist, create it and bind the Skylark SG.
• At the start of a transfer (provision_gateways), add node IPs to the SG.
• Run the transfer
• In deprovision_gateways, first remove each IP from the SG then terminate the instance (not other way around to avoid race condition)

This will allow concurrent transfers to occur.

[parasj]

In a new issue: we should remove the client from the SG and use port 22 to copy a JSON to each instance containing the initial gateway ChunkRequests using SFTP (already implemented) then call curl via SSH to actually start the transfer.

[ShishirPatil]

@ShishirPatil Setup:

* If SG does not exist, create a new Skylark SG. If a VPC does not exist, create it and bind the Skylark SG.

* At the start of a transfer (provision_gateways), add node IPs to the SG.

* Run the transfer

* In deprovision_gateways, first remove each IP from the SG then terminate the instance (not other way around to avoid race condition)

This will allow concurrent transfers to occur.

We cannot support concurrent transfers with the current architecture. This is because - on the source bucket side we will first check if there are any instances up. If there are, then we will just start re-using those instances. However, we don't check if those instances are busy, already engaged in a transfer.