Skip to content

Commit 2f749bf

Browse files
matej5Matej Stajduhar
matej5
and
Matej Stajduhar
authored
New-version-of-aws-acl-role (#1683)
* New-version-of-aws-acl-role * Fixing-jinja-linting --------- Co-authored-by: Matej Stajduhar <matej.stajduhar@codeenigma.com>
1 parent bbad84f commit 2f749bf

File tree

47 files changed

+399
-223
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+399
-223
lines changed

‎roles/aws/_aws_network_info/tasks/subnet.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@
99

1010
- name: Add public subnet to the list.
1111
ansible.builtin.set_fact:
12-
_aws_ecs_cluster_public_subnets_ids: "{{ _aws_ecs_cluster_public_subnets_ids + [ _aws_ecs_cluster_public_subnet.subnets[0].subnet_id ] }}"
12+
_aws_ecs_cluster_public_subnets_ids: "{{ _aws_ecs_cluster_public_subnets_ids + [_aws_ecs_cluster_public_subnet.subnets[0].subnet_id] }}"

‎roles/aws/aws_acl/README.md

+40-28
Original file line numberDiff line numberDiff line change
@@ -5,40 +5,52 @@ Creates an ACL to be attached to a CloudFront distribution or an Application Loa
55
<!--ENDTOC-->
66

77
<!--ROLEVARS-->
8-
## Default variables
8+
## Default variables for creation of ACL (pass it as a list)
99
```yaml
1010
---
11+
---
1112
aws_acl:
12-
- rate_limit: 0 # set to 0 to skip rate limit rule, set to a value to set how many requests to allow in period before blocking
13-
acl_rules:
14-
name: example_master_acl # Name of the ACL
15-
description: "Master ACL for CF"
16-
scope: CLOUDFRONT # Can be REGIONAL for ALBs
17-
tags: {}
18-
19-
botControl: false # Set to true to apply bot control
20-
inspection: "COMMON" # or set to TARGETED inspection level
21-
22-
ip_allow:
23-
name: "Allowed-ips"
24-
list: []
25-
#- 1.1.1.1/32 # list of ip ranges
26-
#- 2.2.2.2/32
27-
#- 3.3.3.3/32
28-
29-
ip_block:
30-
name: "Blocked-ips"
31-
list: []
32-
#- 4.4.4.4/32 # list of ip ranges
33-
#- 5.5.5.5/32
34-
#- 6.6.6.6/32
13+
- name: example_master_acl
14+
description: "Master ACL for CF"
15+
scope: CLOUDFRONT # Can be REGIONAL for ALBs
16+
region: "us-east-1"
17+
tags: {}
18+
rules:
19+
rate_limit: 200 # set to 0 to skip rate limit rule, set to a value to set how many requests to allow in period before blocking
20+
botControl: "COMMON" # or set to TARGETED inspection level (comment out to avoid addign rule)
21+
22+
ip_sets:
23+
- name: "Allowed-ips-example"
24+
action: allow
25+
list: []
26+
#- 1.1.1.1/32 # list of ip ranges
27+
#- 2.2.2.2/32
28+
#- 3.3.3.3/32
29+
- name: "Blocked-ips-example"
30+
action: block
31+
list: []
32+
#- 4.4.4.4/32 # list of ip ranges
33+
#- 5.5.5.5/32
34+
#- 6.6.6.6/32
3535

3636
cc_block_list: []
37-
#- BY # Belarus
38-
#- CN # China
39-
#- IR # Iran
40-
#- SA # Saudi Arabia
4137

38+
regular_rules:
39+
- name: allow_panels
40+
action: allow
41+
string: "panels/ajax"
42+
position: "CONTAINS"
43+
44+
# cyber_sec: #Need to implement task
45+
```
46+
47+
## Default variables for assigning ACL to CF or ALB
48+
```yaml
49+
---
50+
aws_acl:
51+
name: example_master_acl # Name of the ACL to apply
52+
scope: CLOUDFRONT # Can be REGIONAL for ALBs
53+
region: "us-east-1"
4254
```
4355
4456
<!--ENDROLEVARS-->

‎roles/aws/aws_acl/defaults/main.yml

+28-25
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,34 @@
11
---
22
aws_acl:
3-
- rate_limit: 0 # set to 0 to skip rate limit rule, set to a value to set how many requests to allow in period before blocking
4-
acl_rules:
5-
name: example_master_acl # Name of the ACL
6-
description: "Master ACL for CF"
7-
scope: CLOUDFRONT # Can be REGIONAL for ALBs
8-
tags: {}
3+
- name: example_master_acl
4+
description: "Master ACL for CF"
5+
scope: CLOUDFRONT # Can be REGIONAL for ALBs
6+
region: "us-east-1"
7+
tags: {}
8+
rules:
9+
rate_limit: 200 # set to 0 to skip rate limit rule, set to a value to set how many requests to allow in period before blocking
10+
botControl: "COMMON" # or set to TARGETED inspection level (comment out to avoid addign rule)
911

10-
botControl: false # Set to true to apply bot control
11-
inspection: "COMMON" # or set to TARGETED inspection level
12+
ip_sets:
13+
- name: "Allowed-ips-example"
14+
action: allow
15+
list: []
16+
#- 1.1.1.1/32 # list of ip ranges
17+
#- 2.2.2.2/32
18+
#- 3.3.3.3/32
19+
- name: "Blocked-ips-example"
20+
action: block
21+
list: []
22+
#- 4.4.4.4/32 # list of ip ranges
23+
#- 5.5.5.5/32
24+
#- 6.6.6.6/32
1225

13-
ip_allow:
14-
name: "Allowed-ips"
15-
list: []
16-
#- 1.1.1.1/32 # list of ip ranges
17-
#- 2.2.2.2/32
18-
#- 3.3.3.3/32
26+
cc_block_list: []
1927

20-
ip_block:
21-
name: "Blocked-ips"
22-
list: []
23-
#- 4.4.4.4/32 # list of ip ranges
24-
#- 5.5.5.5/32
25-
#- 6.6.6.6/32
28+
regular_rules:
29+
- name: allow_panels
30+
action: allow
31+
string: "panels/ajax"
32+
position: "CONTAINS"
2633

27-
cc_block_list: []
28-
#- BY # Belarus
29-
#- CN # China
30-
#- IR # Iran
31-
#- SA # Saudi Arabia
34+
# cyber_sec: #Need to implement task

‎roles/aws/aws_acl/tasks/bot_control.yml

+14-7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
- name: Define empty action rule list
23
ansible.builtin.set_fact:
34
_action_rules: []
@@ -59,7 +60,7 @@
5960
action_to_use:
6061
block: {}
6162

62-
- name: Define empty action rule list
63+
- name: Attach common action rules to list
6364
ansible.builtin.set_fact:
6465
_action_rules: "{{ _action_rules | default([]) + _action_rules_common }}"
6566

@@ -69,8 +70,8 @@
6970
- a_w_s_managed_rules_bot_control_rule_set:
7071
inspection_level: "COMMON"
7172

72-
- name: Define rule actions targeted
73-
when: aws_acl.inspection == "TARGETED"
73+
- name: Define targeted actions rules
74+
when: _acl.rules.botControl == "TARGETED"
7475
block:
7576
- name: Define targeted actions
7677
ansible.builtin.set_fact:
@@ -97,7 +98,7 @@
9798
action_to_use:
9899
block: {}
99100

100-
- name: Define empty action rule list
101+
- name: Attach targeted action rules to list
101102
ansible.builtin.set_fact:
102103
_action_rules: "{{ _action_rules | default([]) + _action_rules_tgt }}"
103104

@@ -111,8 +112,7 @@
111112
- name: Define Bot Control rule.
112113
ansible.builtin.set_fact:
113114
bot_control:
114-
- name: bot_control
115-
priority: 4
115+
name: bot_control
116116
# action:
117117
# block: {}
118118
override_action:
@@ -128,6 +128,13 @@
128128
managed_rule_group_configs: "{{ _rule_config }}"
129129
rule_action_overrides: "{{ _action_rules }}"
130130

131+
- name: Append priority to rule.
132+
ansible.builtin.set_fact:
133+
bot_control: "{{ bot_control | combine(_priority_dict) }}"
134+
131135
- name: Add rule to list.
132136
ansible.builtin.set_fact:
133-
_acl_rules: "{{ _acl_rules + bot_control}}"
137+
_rules: "{{ _rules + [bot_control] }}"
138+
139+
- name: Increase priority.
140+
ansible.builtin.include_tasks: increase_priority.yml

0 commit comments

Comments
 (0)