From 66a7ce12f30aabe0a835ef840e0a53ec07ded1ca Mon Sep 17 00:00:00 2001 From: tim Date: Wed, 25 Jun 2025 19:08:39 +0300 Subject: [PATCH] security_enhancement --- roles/aws/aws_ami/tasks/repack.yml | 1 + roles/aws/aws_backup_validation/tasks/testing_resources.yml | 1 + roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml | 5 +++++ roles/aws/aws_vpc_subnet/tasks/subnet.yml | 5 +++++ 4 files changed, 12 insertions(+) diff --git a/roles/aws/aws_ami/tasks/repack.yml b/roles/aws/aws_ami/tasks/repack.yml index 75b6a1fbb..47ba4904d 100644 --- a/roles/aws/aws_ami/tasks/repack.yml +++ b/roles/aws/aws_ami/tasks/repack.yml @@ -23,6 +23,7 @@ - 22 cidr_ip: "{{ aws_ami.repack.controller_cidr }}" rule_desc: "Allow controller to access the {{ aws_ami.ami_name }}-repacking instance" + rules_egress: [] - name: Create an AMI with an existing EC2 instance. amazon.aws.ec2_ami: diff --git a/roles/aws/aws_backup_validation/tasks/testing_resources.yml b/roles/aws/aws_backup_validation/tasks/testing_resources.yml index 009a370a2..56fd50eda 100644 --- a/roles/aws/aws_backup_validation/tasks/testing_resources.yml +++ b/roles/aws/aws_backup_validation/tasks/testing_resources.yml @@ -48,6 +48,7 @@ from_port: 22 to_port: 22 cidr_ip: 0.0.0.0/0 + rules_egress: [] register: _restore_testing_sg - name: Remove restore testing query file. diff --git a/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml b/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml index 1e2e2663d..e8f63de73 100644 --- a/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml +++ b/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml @@ -41,6 +41,11 @@ rules: - proto: all group_name: "{{ aws_ec2_autoscale_cluster.name }}" + rule_desc: "Allow internal traffic for cluster {{ aws_ec2_autoscale_cluster.name }}" + rules_egress: + - proto: all + group_name: "{{ aws_ec2_autoscale_cluster.name }}" + rule_desc: "Allow internal traffic for cluster {{ aws_ec2_autoscale_cluster.name }}" register: _aws_ec2_autoscale_cluster_security_group - name: Reset subnets lists. diff --git a/roles/aws/aws_vpc_subnet/tasks/subnet.yml b/roles/aws/aws_vpc_subnet/tasks/subnet.yml index 17f9f7036..3d89ccc5e 100644 --- a/roles/aws/aws_vpc_subnet/tasks/subnet.yml +++ b/roles/aws/aws_vpc_subnet/tasks/subnet.yml @@ -34,6 +34,11 @@ rules: - proto: all group_name: "{{ subnet.name }}" + rule_desc: "Allow internal traffic for subnet {{ subnet.name }}" + rules_egress: + - proto: all + group_name: "{{ subnet.name }}" + rule_desc: "Allow internal traffic for subnet {{ subnet.name }}" when: - subnet.security_group is defined - subnet.security_group