fix(deadline): Close RenderQueue to ingress traffic by default (#51)

aws · Aug 11, 2020 · f1e7c4b · f1e7c4b
1 parent f871d61
commit f1e7c4b
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/packages/aws-rfdk/lib/deadline/lib/render-queue.ts b/packages/aws-rfdk/lib/deadline/lib/render-queue.ts
@@ -338,6 +338,8 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
       // cloudformation updates.
       minHealthyPercent: 0,
       maxHealthyPercent: 100,
+      // This is required to ensure that the ALB listener's security group does not allow any ingress by default.
+      openListener: false,
     });
 
     // An explicit dependency is required from the Service to the Client certificate

diff --git a/packages/aws-rfdk/lib/deadline/test/render-queue.test.ts b/packages/aws-rfdk/lib/deadline/test/render-queue.test.ts
@@ -128,6 +128,15 @@ describe('RenderQueue', () => {
     expectCDK(stack).to(haveResource('AWS::ECS::TaskDefinition'));
   });
 
+  test('closed ingress by default', () => {
+    // THEN
+    expectCDK(stack).notTo(haveResource('AWS::EC2::SecurityGroup', {
+      // The openListener=true option would create an ingress rule in the listener's SG.
+      // make sure that we don't have that.
+      SecurityGroupIngress: arrayWith(objectLike({})),
+    }));
+  });
+
   test('creates load balancer with default values', () => {
     // THEN
     expectCDK(stack).to(countResourcesLike('AWS::ElasticLoadBalancingV2::LoadBalancer', 1, {