Skip to content

Commit e54af57

Browse files
sky333999sky333999
authored
fix: replace 0.0.0.0/0 WinRM SG with per-run runner-scoped SG (#663)
1 parent 6584fe9 commit e54af57

7 files changed

Lines changed: 115 additions & 31 deletions

File tree

‎terraform/ec2/win/main.tf‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,40 @@ locals {
3333
ssm_parameter_name = "WindowsAgentConfigSSMTest-${module.common.testing_id}"
3434
}
3535

36+
#####################################################################
37+
# Per-run Security Group for WinRM access from CI runner
38+
#####################################################################
39+
40+
resource "aws_security_group" "winrm_runner" {
41+
name = "cwagent-integ-win-sg-${module.common.testing_id}"
42+
description = "WinRM access from CI runner for test ${module.common.testing_id}"
43+
vpc_id = module.basic_components.vpc_id
44+
45+
ingress {
46+
description = "WinRM HTTP from CI runner"
47+
from_port = 5985
48+
to_port = 5985
49+
protocol = "tcp"
50+
cidr_blocks = [var.runner_ip]
51+
}
52+
53+
ingress {
54+
description = "WinRM HTTPS from CI runner"
55+
from_port = 5986
56+
to_port = 5986
57+
protocol = "tcp"
58+
cidr_blocks = [var.runner_ip]
59+
}
60+
61+
ingress {
62+
description = "RDP from CI runner"
63+
from_port = 3389
64+
to_port = 3389
65+
protocol = "tcp"
66+
cidr_blocks = [var.runner_ip]
67+
}
68+
}
69+
3670
#####################################################################
3771
# Prepare Parameters Tests
3872
#####################################################################
@@ -59,7 +93,7 @@ resource "aws_instance" "cwagent" {
5993
instance_type = var.ec2_instance_type
6094
key_name = local.ssh_key_name
6195
iam_instance_profile = module.basic_components.instance_profile
62-
vpc_security_group_ids = [module.basic_components.security_group]
96+
vpc_security_group_ids = [module.basic_components.security_group, aws_security_group.winrm_runner.id]
6397
associate_public_ip_address = true
6498
instance_initiated_shutdown_behavior = "terminate"
6599
user_data = length(regexall("/feature/windows/custom_start/userdata", var.test_dir)) > 0 ? data.template_file.user_data.rendered : ""

‎terraform/ec2/win/variable.tf‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,4 +69,10 @@ variable "github_test_repo" {
6969
variable "github_test_repo_branch" {
7070
type = string
7171
default = "main"
72-
}
72+
}
73+
74+
variable "runner_ip" {
75+
type = string
76+
description = "CIDR of the CI runner (e.g. 1.2.3.4/32) allowed to connect via WinRM"
77+
default = "127.0.0.1/32"
78+
}

‎terraform/performance/main.tf‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,32 @@ module "validator" {
4040
values_per_minute = var.values_per_minute
4141
}
4242

43+
#####################################################################
44+
# Per-run Security Group for SSH/WinRM access from CI runner
45+
#####################################################################
46+
47+
resource "aws_security_group" "runner_access" {
48+
name = "cwagent-integ-perf-sg-${module.common.testing_id}"
49+
description = "SSH/WinRM access from CI runner for test ${module.common.testing_id}"
50+
vpc_id = module.basic_components.vpc_id
51+
52+
ingress {
53+
description = "SSH from CI runner"
54+
from_port = 22
55+
to_port = 22
56+
protocol = "tcp"
57+
cidr_blocks = [var.runner_ip]
58+
}
59+
60+
ingress {
61+
description = "WinRM HTTP from CI runner"
62+
from_port = 5985
63+
to_port = 5985
64+
protocol = "tcp"
65+
cidr_blocks = [var.runner_ip]
66+
}
67+
}
68+
4369
#####################################################################
4470
# Generate EC2 Instance and execute test commands
4571
#####################################################################
@@ -49,7 +75,7 @@ resource "aws_instance" "cwagent" {
4975
instance_type = var.ec2_instance_type
5076
key_name = local.ssh_key_name
5177
iam_instance_profile = module.basic_components.instance_profile
52-
vpc_security_group_ids = [module.basic_components.security_group]
78+
vpc_security_group_ids = [module.basic_components.security_group, aws_security_group.runner_access.id]
5379
get_password_data = local.connection_type == "winrm" ? true : false
5480
associate_public_ip_address = true
5581
instance_initiated_shutdown_behavior = "terminate"

‎terraform/performance/variables.tf‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,4 +78,10 @@ variable "github_test_repo_branch" {
7878
variable "run_mock_server" {
7979
type = bool
8080
default = false
81-
}
81+
}
82+
83+
variable "runner_ip" {
84+
type = string
85+
description = "CIDR of the CI runner (e.g. 1.2.3.4/32) allowed to connect via SSH/WinRM"
86+
default = "127.0.0.1/32"
87+
}

‎terraform/setup/vpc.tf‎

Lines changed: 6 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -61,14 +61,6 @@ resource "aws_security_group" "ec2_security_group" {
6161
cidr_blocks = ["0.0.0.0/0"]
6262
}
6363

64-
// OpenSSH and others ssh into EC2 Instance
65-
ingress {
66-
from_port = 22
67-
to_port = 22
68-
protocol = "TCP"
69-
cidr_blocks = ["0.0.0.0/0"]
70-
}
71-
7264
// localstack http and https
7365
ingress {
7466
from_port = 4566
@@ -77,27 +69,15 @@ resource "aws_security_group" "ec2_security_group" {
7769
cidr_blocks = ["0.0.0.0/0"]
7870
}
7971

80-
// WinRM http https://developer.hashicorp.com/terraform/language/resources/provisioners/connection#argument-reference
81-
ingress {
82-
from_port = 5985
83-
to_port = 5985
84-
protocol = "TCP"
85-
cidr_blocks = ["0.0.0.0/0"]
86-
}
72+
// Management ports (WinRM, RDP) are NOT in the shared SG.
73+
// They are created per-run in the compute-specific modules (ec2/win)
74+
// scoped to the CI runner's IP. See terraform/ec2/win/main.tf.
8775

88-
// WinRM https https://developer.hashicorp.com/terraform/language/resources/provisioners/connection#argument-reference
76+
// SSH: still in shared SG until Linux modules are updated to use per-run SGs.
8977
ingress {
90-
from_port = 5986
91-
to_port = 5986
78+
from_port = 22
79+
to_port = 22
9280
protocol = "TCP"
9381
cidr_blocks = ["0.0.0.0/0"]
9482
}
95-
96-
// RDP https://en.wikipedia.org/wiki/Remote_Desktop_Protocol
97-
ingress {
98-
from_port = 3389
99-
to_port = 3389
100-
protocol = "tcp"
101-
cidr_blocks = ["0.0.0.0/0"]
102-
}
10383
}

‎terraform/stress/main.tf‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,32 @@ module "validator" {
4040
values_per_minute = var.values_per_minute
4141
}
4242

43+
#####################################################################
44+
# Per-run Security Group for SSH/WinRM access from CI runner
45+
#####################################################################
46+
47+
resource "aws_security_group" "runner_access" {
48+
name = "cwagent-integ-stress-sg-${module.common.testing_id}"
49+
description = "SSH/WinRM access from CI runner for test ${module.common.testing_id}"
50+
vpc_id = module.basic_components.vpc_id
51+
52+
ingress {
53+
description = "SSH from CI runner"
54+
from_port = 22
55+
to_port = 22
56+
protocol = "tcp"
57+
cidr_blocks = [var.runner_ip]
58+
}
59+
60+
ingress {
61+
description = "WinRM HTTP from CI runner"
62+
from_port = 5985
63+
to_port = 5985
64+
protocol = "tcp"
65+
cidr_blocks = [var.runner_ip]
66+
}
67+
}
68+
4369
#####################################################################
4470
# Generate EC2 Instance and execute test commands
4571
#####################################################################
@@ -49,7 +75,7 @@ resource "aws_instance" "cwagent" {
4975
instance_type = var.ec2_instance_type
5076
key_name = local.ssh_key_name
5177
iam_instance_profile = module.basic_components.instance_profile
52-
vpc_security_group_ids = [module.basic_components.security_group]
78+
vpc_security_group_ids = [module.basic_components.security_group, aws_security_group.runner_access.id]
5379
get_password_data = local.connection_type == "winrm" ? true : false
5480
associate_public_ip_address = true
5581
instance_initiated_shutdown_behavior = "terminate"

‎terraform/stress/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,3 +66,9 @@ variable "family" {
6666
error_message = "Valid values for family are (windows, linux)."
6767
}
6868
}
69+
70+
variable "runner_ip" {
71+
type = string
72+
description = "CIDR of the CI runner (e.g. 1.2.3.4/32) allowed to connect via SSH/WinRM"
73+
default = "127.0.0.1/32"
74+
}

0 commit comments

Comments
 (0)