Fix: AWS Security Hub: CIS AWS Foundations Benchmark Critical and High Finding (DataBiosphere/azul-private#173) #6553

dsotirho-ucsc · 2024-09-10T01:11:28Z

Connected issues: DataBiosphere/azul-private#173

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after approval)

PR is not a draft
Ticket is in Review requested column
PR is awaiting requested review from system administrator
PR is assigned to only the system administrator

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved connected issues to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2024-09-10T01:31:22Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.38%. Comparing base (6e66a5b) to head (93601bf).
Report is 2 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #6553   +/-   ##
========================================
  Coverage    85.38%   85.38%           
========================================
  Files          155      155           
  Lines        20735    20735           
========================================
  Hits         17704    17704           
  Misses        3031     3031

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

coveralls · 2024-09-10T01:32:41Z

coverage: 85.399%. remained the same
when pulling 93601bf on issues/dsotirho-ucsc/173-global-ingress
into 6e66a5b on develop.

dsotirho-ucsc · 2024-09-10T19:28:36Z

6553_IT_2024-09-10.txt

Terraform plan for dev.gitlab:

Terraform will perform the following actions:

  # aws_security_group.gitlab_vpn will be updated in-place
  ~ resource "aws_security_group" "gitlab_vpn" {
        id                     = "sg-04e8bcb2d3089607c"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "ICMP for PMTUD"
              - from_port        = 3
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "icmp"
              - security_groups  = []
              - self             = false
              - to_port          = 4
            },
          + {
              + cidr_blocks      = [
                  + "172.21.0.0/16",
                ]
              + description      = "ICMP for PMTUD"
              + from_port        = 3
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "icmp"
              + security_groups  = []
              + self             = false
              + to_port          = 4
            },
            # (1 unchanged element hidden)
        ]
        name                   = "azul-gitlab-vpn"
        tags                   = {
            "Name"                = "azul-gitlab_vpn"
            "billing"             = "hca"
            "component"           = "azul-gitlab_vpn"
            "deployment"          = "dev"
            "owner"               = "hannes@ucsc.edu"
            "service"             = "azul"
            "terraform_component" = "gitlab"
        }
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

achave11-ucsc

LGTM ✅

hannes-ucsc · 2024-09-11T17:42:40Z

terraform/gitlab/gitlab.tf.json.template.py

-                                      cidr_blocks=[all_ipv4],
+                                      cidr_blocks=['${aws_vpc.gitlab.cidr_block}'],


Let's remove this change. We don't get flagged for it on the other security groups and it would be odd to be inconsistent.

dsotirho-ucsc · 2024-09-12T00:49:59Z

6553_IT_2024-09-11.txt

hannes-ucsc · 2024-09-13T02:43:53Z

hannes-ucsc · 2024-09-13T03:34:35Z

Security design review: This change makes an ingress rule in the security group (SG) more restrictive. The originally more permissive ingress rule allowed traffic from anywhere (0.0.0.0:0) but that did not pose a threat due to the fact that the SG applied to interfaces in a private subnet (10.x.x.x), the subnet for the local VPN tunnel ends, that are only reachable from the other subnets in the VPC, or the remote end of a VPN tunnel. Establishing a tunnel requires authentication and credentials are only issued to internal users (team members).

…h Finding #173)

dsotirho-ucsc added the deploy:gitlab [process] PR requires deploying `gitlab` component label Sep 10, 2024

dsotirho-ucsc requested a review from hannes-ucsc as a code owner September 10, 2024 01:11

github-actions bot added the orange [process] Done by the Azul team label Sep 10, 2024

dsotirho-ucsc requested a review from achave11-ucsc September 10, 2024 20:45

dsotirho-ucsc assigned achave11-ucsc Sep 10, 2024

achave11-ucsc previously approved these changes Sep 11, 2024

View reviewed changes

achave11-ucsc assigned hannes-ucsc and unassigned achave11-ucsc Sep 11, 2024

hannes-ucsc requested changes Sep 11, 2024

View reviewed changes

hannes-ucsc added the 0 reviews [process] Lead didn't request any changes label Sep 11, 2024

hannes-ucsc removed their assignment Sep 11, 2024

dsotirho-ucsc dismissed achave11-ucsc’s stale review via 62abdc4 September 11, 2024 23:49

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/173-global-ingress branch from 62abdc4 to 5aed963 Compare September 12, 2024 00:14

dsotirho-ucsc requested a review from hannes-ucsc September 12, 2024 00:50

dsotirho-ucsc assigned hannes-ucsc Sep 12, 2024

hannes-ucsc approved these changes Sep 13, 2024

View reviewed changes

hannes-ucsc added the no sandbox [process] PR will not be tested in the sandbox label Sep 13, 2024

hannes-ucsc assigned achave11-ucsc and unassigned hannes-ucsc Sep 13, 2024

Fix: AWS Security Hub: CIS AWS Foundations Benchmark Critical and Hig…

93601bf

…h Finding #173)

achave11-ucsc force-pushed the issues/dsotirho-ucsc/173-global-ingress branch from 5aed963 to 93601bf Compare September 13, 2024 17:55

hannes-ucsc merged commit 850a1e8 into develop Sep 13, 2024
9 checks passed

achave11-ucsc deleted the issues/dsotirho-ucsc/173-global-ingress branch September 16, 2024 17:00

achave11-ucsc assigned dsotirho-ucsc Sep 16, 2024

achave11-ucsc removed their assignment Sep 16, 2024

dsotirho-ucsc removed their assignment Sep 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: AWS Security Hub: CIS AWS Foundations Benchmark Critical and High Finding (DataBiosphere/azul-private#173) #6553

Fix: AWS Security Hub: CIS AWS Foundations Benchmark Critical and High Finding (DataBiosphere/azul-private#173) #6553

dsotirho-ucsc commented Sep 10, 2024 •

edited

Loading

codecov bot commented Sep 10, 2024 •

edited

Loading

coveralls commented Sep 10, 2024 •

edited

Loading

dsotirho-ucsc commented Sep 10, 2024

achave11-ucsc left a comment

hannes-ucsc Sep 11, 2024

dsotirho-ucsc commented Sep 12, 2024

hannes-ucsc commented Sep 13, 2024 •

edited

Loading

hannes-ucsc commented Sep 13, 2024

		cidr_blocks=[all_ipv4],
		cidr_blocks=['${aws_vpc.gitlab.cidr_block}'],

Fix: AWS Security Hub: CIS AWS Foundations Benchmark Critical and High Finding (DataBiosphere/azul-private#173) #6553

Fix: AWS Security Hub: CIS AWS Foundations Benchmark Critical and High Finding (DataBiosphere/azul-private#173) #6553

Conversation

dsotirho-ucsc commented Sep 10, 2024 • edited Loading

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

codecov bot commented Sep 10, 2024 • edited Loading

Codecov Report

coveralls commented Sep 10, 2024 • edited Loading

dsotirho-ucsc commented Sep 10, 2024

achave11-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc Sep 11, 2024

Choose a reason for hiding this comment

dsotirho-ucsc commented Sep 12, 2024

hannes-ucsc commented Sep 13, 2024 • edited Loading

Security design review

hannes-ucsc commented Sep 13, 2024

dsotirho-ucsc commented Sep 10, 2024 •

edited

Loading

codecov bot commented Sep 10, 2024 •

edited

Loading

coveralls commented Sep 10, 2024 •

edited

Loading

hannes-ucsc commented Sep 13, 2024 •

edited

Loading