Secure security group rules

[PyMedic]

closes #22

[PyMedic]

For DatabaseClientSecurityGroup, I added the outbound rules for:

• TCP Port 5432, Destination: DatabaseSecurityGroup
  • To allow access to the Canvas Data 2 RDS cluster.
• TCP 443, Destination: 0.0.0.0/0
  • To allow access to the Canvas Data API

For EmptySecurityGroup, which executes the ListTables Lambda function, I added the outbound to rule for:

• TCP 443, Destination: 0.0.0.0/0
  • To allow access to the Canvas Data API

I deployed the changes to ubcla-stg.

I tested EmptySecurityGroup by running the ubcla-canvas-data-2-ListTablesFunction in ubcla-stg, and it worked properly.

I also executed the ubcla-canvas-data-2-state-machine, and it ran successfully.

[jlongland]

Thanks Sung. I noted a couple of small changes.

[jlongland]

Be mindful of conditions we should cover to keep our changes upstream friendly.

1. CreateDatabaseSecurityGroup
2. ExistingDatabaseSecurityGroup - Where someone has an existing database security group that they'd like to use.

I'd do this:

  DatabaseClientEgressToDatabase:
    Type: AWS::EC2::SecurityGroupEgress
    Condition: CreateDatabaseSecurityGroup
    Properties:
      GroupId: !Ref DatabaseClientSecurityGroup
      IpProtocol: tcp
      FromPort: 5432
      ToPort: 5432
      DestinationSecurityGroupId: !GetAtt DatabaseSecurityGroup.GroupId

  DatabaseClientEgressToExistingDatabase:
    Type: AWS::EC2::SecurityGroupEgress
    Condition: ExistingDatabaseSecurityGroup
    Properties:
      GroupId: !Ref DatabaseClientSecurityGroup
      IpProtocol: tcp
      FromPort: 5432
      ToPort: 5432
      DestinationSecurityGroupId: !Ref DatabaseSecurityGroupParameter       

[jlongland]

It's not specific to your changes, but I noticed the group is unnamed. Can you add a GroupName like Canvas Data 2 Database Client?

Edit: This comment refers to the DatabaseClientSecurityGroup, not sure how it ended up attaching to the tag.

[jlongland]

It's not specific to your change, but the naming of this resource has always bugged me. ListFunctionSecurityGroup is more descriptive than EmptySecurityGroup. Can you change it and also add a GroupName like Canvas Data 2 ListFunction?

[PyMedic]

@jlongland I made the changes.

Tested on ubcla-stg.