cfn-vpn 1.1.1 → 1.3.3

data/lib/cfnvpn/templates/vpn.rb

@@ -1,5 +1,6 @@
 require 'cfndsl'
 require 'cfnvpn/templates/helper'
+require 'cfnvpn/templates/lambdas'
 
 module CfnVpn
   module Templates
@@ -32,10 +33,17 @@ module CfnVpn
             {
               FederatedAuthentication: {
                 SAMLProviderArn: config[:saml_arn],
-                SelfServiceSAMLProviderArn: config[:saml_arn]
+                SelfServiceSAMLProviderArn: config[:saml_self_service_arn].nil? ? config[:saml_arn] : config[:saml_self_service_arn]
               },
               Type: 'federated-authentication'
             }
+          elsif config[:type] == 'active-directory'
+            {
+              ActiveDirectory: {
+                DirectoryId: config[:directory_id]
+              },
+              Type: 'directory-service-authentication'
+            }
           else
             {
               MutualAuthentication: {
@@ -62,6 +70,7 @@ module CfnVpn
           SplitTunnel config[:split_tunnel]
         }
 
+        network_assoc_dependson = []
         config[:subnet_ids].each_with_index do |subnet, index|
           suffix = index == 0 ? "" : "For#{subnet.resource_safe}"
 
@@ -71,74 +80,112 @@ module CfnVpn
             SubnetId subnet
           }
 
-          if config[:default_groups].any?
-            config[:default_groups].each do |group|
-              EC2_ClientVpnAuthorizationRule(:"TargetNetworkAuthorizationRule#{suffix}#{group.resource_safe}"[0..255]) {
-                Condition(:EnableSubnetAssociation)
-                DependsOn "ClientVpnTargetNetworkAssociation#{suffix}"
-                Description FnSub("#{name} client-vpn auth rule for subnet association")
-                AccessGroupId group
-                ClientVpnEndpointId Ref(:ClientVpnEndpoint)
-                TargetNetworkCidr CfnVpn::Templates::Helper.get_auth_cidr(config[:region], subnet)
-              }
-            end
-          else
-            EC2_ClientVpnAuthorizationRule(:"TargetNetworkAuthorizationRule#{suffix}") {
+          network_assoc_dependson << "ClientVpnTargetNetworkAssociation#{suffix}"
+        end
+
+        if config[:default_groups].any?
+          config[:default_groups].each do |group|
+            EC2_ClientVpnAuthorizationRule(:"TargetNetworkAuthorizationRule#{group.resource_safe}"[0..255]) {
               Condition(:EnableSubnetAssociation)
-              DependsOn "ClientVpnTargetNetworkAssociation#{suffix}"
+              DependsOn network_assoc_dependson if network_assoc_dependson.any?
               Description FnSub("#{name} client-vpn auth rule for subnet association")
-              AuthorizeAllGroups true
+              AccessGroupId group
               ClientVpnEndpointId Ref(:ClientVpnEndpoint)
-              TargetNetworkCidr CfnVpn::Templates::Helper.get_auth_cidr(config[:region], subnet)
+              TargetNetworkCidr CfnVpn::Templates::Helper.get_auth_cidr(config[:region], config[:subnet_ids].first)
             }
           end
+        else
+          EC2_ClientVpnAuthorizationRule(:"TargetNetworkAuthorizationRule") {
+            Condition(:EnableSubnetAssociation)
+            DependsOn network_assoc_dependson if network_assoc_dependson.any?
+            Description FnSub("#{name} client-vpn auth rule for subnet association")
+            AuthorizeAllGroups true
+            ClientVpnEndpointId Ref(:ClientVpnEndpoint)
+            TargetNetworkCidr CfnVpn::Templates::Helper.get_auth_cidr(config[:region], config[:subnet_ids].first)
+          }
+        end
 
-          if subnet == config[:internet_route]
-            EC2_ClientVpnRoute(:RouteToInternet) {
-              Condition(:EnableSubnetAssociation)
-              DependsOn "ClientVpnTargetNetworkAssociation#{suffix}"
-              Description 'Route to the internet'
-              ClientVpnEndpointId Ref(:ClientVpnEndpoint)
-              DestinationCidrBlock '0.0.0.0/0'
-              TargetVpcSubnetId config[:internet_route]
+        if !config[:internet_route].nil?
+          EC2_ClientVpnRoute(:RouteToInternet) {
+            Condition(:EnableSubnetAssociation)
+            DependsOn network_assoc_dependson if network_assoc_dependson.any?
+            Description "Route to the internet through subnet #{config[:internet_route]}"
+            ClientVpnEndpointId Ref(:ClientVpnEndpoint)
+            DestinationCidrBlock '0.0.0.0/0'
+            TargetVpcSubnetId config[:internet_route]
+          }
+        
+          EC2_ClientVpnAuthorizationRule(:RouteToInternetAuthorizationRule) {
+            Condition(:EnableSubnetAssociation)
+            DependsOn network_assoc_dependson if network_assoc_dependson.any?
+            Description "Internet route authorization from subnet #{config[:internet_route]}"
+            AuthorizeAllGroups true
+            ClientVpnEndpointId Ref(:ClientVpnEndpoint)
+            TargetNetworkCidr '0.0.0.0/0'
+          }
+
+          output(:InternetRoute, config[:internet_route])
+        end
+
+        dns_routes = config[:routes].select {|route| route.has_key?(:dns)}
+        cidr_routes = config[:routes].select {|route| route.has_key?(:cidr)}
+
+        if dns_routes.any?
+          auto_route_populator(name, config[:bucket])
+
+          dns_routes.each do |route|
+            input = { 
+              Record: route[:dns],
+              ClientVpnEndpointId: "${ClientVpnEndpoint}",
+              TargetSubnet: route[:subnet],
+              Description: route[:desc]
             }
-          
-            EC2_ClientVpnAuthorizationRule(:RouteToInternetAuthorizationRule) {
-              Condition(:EnableSubnetAssociation)
-              DependsOn "ClientVpnTargetNetworkAssociation#{suffix}"
-              Description 'Route to the internet'
-              AuthorizeAllGroups true
-              ClientVpnEndpointId Ref(:ClientVpnEndpoint)
-              TargetNetworkCidr '0.0.0.0/0'
+            
+            if route[:groups].any?
+              input[:Groups] = route[:groups]
+            end
+
+            Events_Rule(:"CfnVpnAutoRoutePopulatorEvent#{route[:dns].resource_safe}"[0..255]) {
+              State 'ENABLED'
+              Description "cfnvpn auto route populator schedule for #{route[:dns]}"
+              ScheduleExpression "rate(5 minutes)"
+              Targets([
+                { 
+                  Arn: FnGetAtt(:CfnVpnAutoRoutePopulator, :Arn),
+                  Id: "cfnvpnautoroutepopulator#{route[:dns].event_id_safe}",
+                  Input: FnSub(input.to_json)
+                }
+              ])
             }
-  
-            output(:InternetRoute, config[:internet_route])
           end
         end
 
-        config[:routes].each do |route|
-          EC2_ClientVpnRoute(:"#{route[:cidr].resource_safe}VpnRoute") {
-            Description route[:desc]
-            ClientVpnEndpointId Ref(:ClientVpnEndpoint)
-            DestinationCidrBlock route[:cidr]
-            TargetVpcSubnetId route[:subnet]
-          }
-          if route[:groups].any?
-            route[:groups].each do |group|
-              EC2_ClientVpnAuthorizationRule(:"#{route[:cidr].resource_safe}AuthorizationRule#{group.resource_safe}"[0..255]) {
-                Description route[:desc]
-                AccessGroupId group
+        if cidr_routes.any?
+          cidr_routes.each do |route|
+            EC2_ClientVpnRoute(:"#{route[:cidr].resource_safe}VpnRoute") {
+              Description "cfnvpn static route for #{route[:cidr]}. #{route[:desc]}".strip
+              ClientVpnEndpointId Ref(:ClientVpnEndpoint)
+              DestinationCidrBlock route[:cidr]
+              TargetVpcSubnetId route[:subnet]
+            }
+
+            if route[:groups].any?
+              route[:groups].each do |group|
+                EC2_ClientVpnAuthorizationRule(:"#{route[:cidr].resource_safe}AuthorizationRule#{group.resource_safe}"[0..255]) {
+                  Description "cfnvpn static authorization rule for group #{group} to route #{route[:cidr]}. #{route[:desc]}".strip
+                  AccessGroupId group
+                  ClientVpnEndpointId Ref(:ClientVpnEndpoint)
+                  TargetNetworkCidr route[:cidr]
+                }
+              end
+            else
+              EC2_ClientVpnAuthorizationRule(:"#{route[:cidr].resource_safe}AllowAllAuthorizationRule") {
+                Description "cfnvpn static allow all authorization rule to route #{route[:cidr]}. #{route[:desc]}".strip
+                AuthorizeAllGroups true
                 ClientVpnEndpointId Ref(:ClientVpnEndpoint)
                 TargetNetworkCidr route[:cidr]
               }
             end
-          else
-            EC2_ClientVpnAuthorizationRule(:"#{route[:cidr].resource_safe}AllowAllAuthorizationRule") {
-              Description route[:desc]
-              AuthorizeAllGroups true
-              ClientVpnEndpointId Ref(:ClientVpnEndpoint)
-              TargetNetworkCidr route[:cidr]
-            }
           end
         end
         
@@ -149,13 +196,13 @@ module CfnVpn
           Type 'String'
           Value config.to_json
           Tags({
-            Name:  "#{name}-cfnvpn-config",
+            Name: "#{name}-cfnvpn-config",
             Environment: 'cfnvpn'
           })
         }
 
         if config[:start] || config[:stop]
-          scheduler(name, config[:start], config[:stop])
+          scheduler(name, config[:start], config[:stop], config[:bucket])
           output(:Start, config[:start]) if config[:start]
           output(:Stop, config[:stop]) if config[:stop]
         end
@@ -170,6 +217,8 @@ module CfnVpn
 
         if config[:type] == 'federated'
           output(:SamlArn, config[:saml_arn])
+        elsif config[:type] == 'active-directory'
+          output(:DirectoryId, config[:directory_id])
         else
           output(:ClientCertArn, config[:client_cert_arn])
         end
@@ -179,7 +228,92 @@ module CfnVpn
         Output(name) { Value value }
       end
 
-      def scheduler(name, start, stop)
+      def auto_route_populator(name, bucket)
+        IAM_Role(:CfnVpnAutoRoutePopulatorRole) {
+          AssumeRolePolicyDocument({
+            Version: '2012-10-17',
+            Statement: [{
+              Effect: 'Allow',
+              Principal: { Service: [ 'lambda.amazonaws.com' ] },
+              Action: [ 'sts:AssumeRole' ]
+            }]
+          })
+          Path '/cfnvpn/'
+          Policies([
+            {
+              PolicyName: 'client-vpn',
+              PolicyDocument: {
+                Version: '2012-10-17',
+                Statement: [{
+                  Effect: 'Allow',
+                  Action: [ 
+                    'ec2:AuthorizeClientVpnIngress',
+                    'ec2:RevokeClientVpnIngress',
+                    'ec2:DescribeClientVpnAuthorizationRules',
+                    'ec2:DescribeClientVpnEndpoints',
+                    'ec2:DescribeClientVpnRoutes',
+                    'ec2:CreateClientVpnRoute',
+                    'ec2:DeleteClientVpnRoute'
+                  ],
+                  Resource: '*'
+                }]
+              }
+            },
+            {
+              PolicyName: 'logging',
+              PolicyDocument: {
+                Version: '2012-10-17',
+                Statement: [{
+                  Effect: 'Allow',
+                  Action: [
+                    'logs:DescribeLogGroups',
+                    'logs:CreateLogGroup',
+                    'logs:CreateLogStream',
+                    'logs:DescribeLogStreams',
+                    'logs:PutLogEvents'
+                  ],
+                  Resource: '*'
+                }]
+              }
+            }
+          ])
+          Tags([
+            { Key: 'Name', Value: "#{name}-cfnvpn-auto-route-populator-role" },
+            { Key: 'Environment', Value: 'cfnvpn' }
+          ])
+        }
+
+        s3_key = CfnVpn::Templates::Lambdas.package_lambda(name: name, bucket: bucket, func: 'auto_route_populator', files: ['app.py'])
+        
+        Lambda_Function(:CfnVpnAutoRoutePopulator) {
+          Runtime 'python3.8'
+          Role FnGetAtt(:CfnVpnAutoRoutePopulatorRole, :Arn)
+          MemorySize '128'
+          Handler 'app.handler'
+          Timeout 60
+          Code({
+            S3Bucket: bucket,
+            S3Key: s3_key
+          })
+          Tags([
+            { Key: 'Name', Value: "#{name}-cfnvpn-auto-route-populator" },
+            { Key: 'Environment', Value: 'cfnvpn' }
+          ])
+        }
+
+        Logs_LogGroup(:CfnVpnAutoRoutePopulatorLogGroup) {
+          LogGroupName FnSub("/aws/lambda/${CfnVpnAutoRoutePopulator}")
+          RetentionInDays 30
+        }
+
+        Lambda_Permission(:CfnVpnAutoRoutePopulatorFunctionPermissions) {
+          FunctionName Ref(:CfnVpnAutoRoutePopulator)
+          Action 'lambda:InvokeFunction'
+          Principal 'events.amazonaws.com'
+        }
+      end
+
+      def scheduler(name, start, stop, bucket)
         IAM_Role(:ClientVpnSchedulerRole) {
           AssumeRolePolicyDocument({
             Version: '2012-10-17',
@@ -249,46 +383,17 @@ module CfnVpn
           ])
         }
 
+        s3_key = CfnVpn::Templates::Lambdas.package_lambda(name: name, bucket: bucket, func: 'scheduler', files: ['app.py'])
+
         Lambda_Function(:ClientVpnSchedulerFunction) {
-          Runtime 'python3.7'
+          Runtime 'python3.8'
           Role FnGetAtt(:ClientVpnSchedulerRole, :Arn)
           MemorySize '128'
-          Handler 'index.handler'
+          Handler 'app.handler'
+          Timeout 60
           Code({
-            ZipFile: <<~EOS
-            import boto3
-
-            def handler(event, context):
-
-              print(f"updating cfn-vpn stack {event['StackName']} parameter AssociateSubnets with value {event['AssociateSubnets']}")
-
-              if event['AssociateSubnets'] == 'false':
-                print(f"terminating current vpn sessions to {event['ClientVpnEndpointId']}")
-                ec2 = boto3.client('ec2')
-                resp = ec2.describe_client_vpn_connections(ClientVpnEndpointId=event['ClientVpnEndpointId'])
-                for conn in resp['Connections']:
-                  if conn['Status']['Code'] == 'active':
-                    ec2.terminate_client_vpn_connections(
-                      ClientVpnEndpointId=event['ClientVpnEndpointId'],
-                      ConnectionId=conn['ConnectionId']
-                    )
-                    print(f"terminated session {conn['ConnectionId']}")
-
-              client = boto3.client('cloudformation')
-              print(client.update_stack(
-                StackName=event['StackName'],
-                UsePreviousTemplate=True,
-                Capabilities=['CAPABILITY_IAM'],
-                Parameters=[
-                  {
-                    'ParameterKey': 'AssociateSubnets',
-                    'ParameterValue': event['AssociateSubnets']
-                  }
-                ]
-              ))
-
-              return 'OK'
-            EOS
+            S3Bucket: bucket,
+            S3Key: s3_key
           })
           Tags([
             { Key: 'Name', Value: "#{name}-cfnvpn-scheduler-function" },

data/lib/cfnvpn/version.rb

@@ -1,4 +1,4 @@
 module CfnVpn
-  VERSION = "1.1.1".freeze
+  VERSION = "1.3.3".freeze
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-vpn
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.3.3
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-02-15 00:00:00.000000000 Z
+date: 2021-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -78,6 +78,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 2.0.4
+- !ruby/object:Gem::Dependency
+  name: rubyzip
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ec2
   requirement: !ruby/object:Gem::Requirement
@@ -254,8 +268,12 @@ files:
 - lib/cfnvpn/globals.rb
 - lib/cfnvpn/log.rb
 - lib/cfnvpn/s3.rb
+- lib/cfnvpn/s3_bucket.rb
 - lib/cfnvpn/string.rb
 - lib/cfnvpn/templates/helper.rb
+- lib/cfnvpn/templates/lambdas.rb
+- lib/cfnvpn/templates/lambdas/auto_route_populator/app.py
+- lib/cfnvpn/templates/lambdas/scheduler/app.py
 - lib/cfnvpn/templates/vpn.rb
 - lib/cfnvpn/version.rb
 homepage: https://github.com/base2services/aws-client-vpn
@@ -279,7 +297,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.1.6
 signing_key: 
 specification_version: 4
 summary: creates and manages resources for the aws client vpn