mongo 2.12.4 → 2.13.0.beta1

data/spec/support/aws_utils/orchestrator.rb

@@ -0,0 +1,370 @@
+module AwsUtils
+  class Orchestrator < Base
+
+    def assume_role(role_arn)
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/STS/Client.html#assume_role-instance_method
+      resp = sts_client.assume_role(
+        role_arn: role_arn,
+        role_session_name: "#{NAMESPACE}.test",
+      )
+      resp.credentials
+    end
+
+    def set_instance_profile(instance_id,
+      instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+      instance_profile_arn: nil
+    )
+      clear_instance_profile(instance_id)
+
+      deadline = Time.now + 30
+      begin
+        ec2_client.associate_iam_instance_profile(
+          iam_instance_profile: {
+            name: instance_profile_name,
+            arn: instance_profile_arn,
+          },
+          instance_id: instance_id,
+        )
+      rescue Aws::EC2::Errors::RequestLimitExceeded => e
+        if Time.now >= deadline
+          raise
+        end
+        STDERR.puts("AWS request limit exceeded: #{e.class}: #{e}, will retry")
+        sleep 5
+        retry
+      end
+    end
+
+    def clear_instance_profile(instance_id)
+      assoc = detect_object(ec2_client.describe_iam_instance_profile_associations,
+        :iam_instance_profile_associations, :instance_id, instance_id)
+
+      if assoc
+        deadline = Time.now + 30
+        begin
+          ec2_client.disassociate_iam_instance_profile(
+            association_id: assoc.association_id,
+          )
+        rescue Aws::EC2::Errors::RequestLimitExceeded => e
+          if Time.now >= deadline
+            raise
+          end
+          STDERR.puts("AWS request limit exceeded: #{e.class}: #{e}, will retry")
+          sleep 5
+          retry
+        end
+      end
+    end
+
+    def provision_auth_ec2_instance(key_pair_name: nil, public_key_path: nil,
+      distro: 'ubuntu1604'
+    )
+      security_group_id = ssh_security_group_id!
+      reservations = ec2_client.describe_instances(filters: [
+        {name: 'tag:name', values: [AWS_AUTH_EC2_INSTANCE_NAME]},
+      ]).reservations
+      instance = find_running_instance(reservations)
+      if instance.nil?
+        ami_name = AWS_AUTH_EC2_AMI_NAMES.fetch(distro)
+        image = ec2_client.describe_images(
+          filters: [{name: 'name', values: [ami_name]}],
+        ).images.first
+        if public_key_path
+          public_key = File.read(public_key_path)
+          user_data = Base64.encode64(<<-CMD)
+#!/bin/sh
+for user in `ls /home`; do
+cd /home/$user &&
+mkdir -p .ssh &&
+chmod 0700 .ssh &&
+chown $user:$user .ssh &&
+cat <<-EOT |tee -a .ssh/authorized_keys
+#{public_key}
+EOT
+done
+CMD
+        end
+        resp = ec2_client.run_instances(
+          instance_type: 't3a.small',
+          image_id: image.image_id,
+          min_count: 1,
+          max_count: 1,
+          key_name: key_pair_name,
+          user_data: user_data,
+          tag_specifications: [{
+            resource_type: 'instance',
+            tags: [{key: 'name', value: AWS_AUTH_EC2_INSTANCE_NAME}],
+          }],
+          monitoring: {enabled: false},
+          credit_specification: {cpu_credits: 'standard'},
+          security_group_ids: [security_group_id],
+          metadata_options: {
+            # This is required for Docker containers on the instance to be able
+            # to use the instance metadata endpoints.
+            http_put_response_hop_limit: 2,
+          },
+        ).to_h
+        instance_id = resp[:instances].first[:instance_id]
+        reservations = ec2_client.describe_instances(instance_ids: [instance_id]).reservations
+        instance = find_running_instance(reservations)
+      end
+      if instance.nil?
+        raise "Instance should have been found here"
+      end
+      if instance.state.name == 'stopped'
+        ec2_client.start_instances(instance_ids: [instance.instance_id])
+      end
+      10.times do
+        if %w(stopped pending).include?(instance.state.name)
+          puts "Waiting for instance #{instance.instance_id} to start (current state: #{instance.state.name})"
+          sleep 5
+        end
+        reservations = ec2_client.describe_instances(instance_ids: [instance.instance_id]).reservations
+        instance = find_running_instance(reservations)
+      end
+      puts "Found usable instance #{instance.instance_id} at #{instance.public_ip_address}"
+    end
+
+    def terminate_auth_ec2_instance
+      ec2_client.describe_instances(filters: [
+        {name: 'tag:name', values: [AWS_AUTH_EC2_INSTANCE_NAME]},
+      ]).each do |resp|
+        resp.reservations.each do |res|
+          res.instances.each do |instance|
+            puts "Terminating #{instance.instance_id}"
+            ec2_client.terminate_instances(instance_ids: [instance.instance_id])
+          end
+        end
+      end
+    end
+
+    def provision_auth_ecs_task(public_key_path: nil,
+      cluster_name: AWS_AUTH_ECS_CLUSTER_NAME,
+      service_name: AWS_AUTH_ECS_SERVICE_NAME,
+      security_group_id: nil,
+      subnet_ids: nil,
+      task_definition_ref: AWS_AUTH_ECS_TASK_FAMILY
+    )
+      security_group_id ||= ssh_vpc_security_group_id!
+      subnet_ids ||= [subnet_id!]
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_AWSCLI_Fargate.html
+      resp = ecs_client.describe_clusters(
+        clusters: [cluster_name],
+      )
+      cluster = detect_object(resp, :clusters, :cluster_name, cluster_name)
+      if cluster.nil?
+        raise 'No cluster found, please run `aws setup-resources`'
+      end
+
+      if public_key_path
+        public_key = File.read(public_key_path)
+        unless public_key =~ /\Assh-/
+          raise "The file at #{public_key_path} does not look like a public key"
+        end
+        entry_point = ['bash', '-c', <<-CMD]
+          apt-get update &&
+          apt-get install -y openssh-server &&
+          cd /root &&
+          mkdir -p .ssh &&
+          chmod 0700 .ssh &&
+          cat >.ssh/authorized_keys  <<-EOT &&
+#{public_key}
+EOT
+          service ssh start &&
+          sleep 10000000
+          #mkdir /run/sshd && /usr/sbin/sshd -d
+CMD
+      else
+        entry_point = nil
+      end
+      launch_type = if options[:ec2]
+        'EC2'
+      else
+        'FARGATE'
+      end
+      # When testing in Evergreen, we are given the task definition ARN
+      # and we always launch the tasks with that ARN.
+      # When testing locally, we repace task definition every time we launch
+      # the service.
+      if task_definition_ref !~ /^arn:/
+        execution_role = detect_object(iam_client.list_roles, :roles, :role_name, AWS_AUTH_ECS_EXECUTION_ROLE_NAME)
+        if execution_role.nil?
+          raise 'Execution role not configured'
+        end
+        task_role = detect_object(iam_client.list_roles, :roles, :role_name, AWS_AUTH_ECS_TASK_ROLE_NAME)
+        if task_role.nil?
+          raise 'Task role not configured'
+        end
+
+        task_definition = ecs_client.register_task_definition(
+          family: AWS_AUTH_ECS_TASK_FAMILY,
+          container_definitions: [{
+            name: 'ssh',
+            essential: true,
+            entry_point: entry_point,
+            image: 'debian:9',
+            port_mappings: [{
+              container_port: 22,
+              protocol: 'tcp',
+            }],
+            log_configuration: {
+              log_driver: 'awslogs',
+              options: {
+                'awslogs-group' => AWS_AUTH_ECS_LOG_GROUP,
+                'awslogs-region' => region,
+                'awslogs-stream-prefix' => AWS_AUTH_ECS_LOG_STREAM_PREFIX,
+              },
+            },
+          }],
+          requires_compatibilities: [launch_type],
+          network_mode: 'awsvpc',
+          cpu: '512',
+          memory: '2048',
+          # This is the ECS task role used for AWS auth testing
+          task_role_arn: task_role.arn,
+          # The execution role is required to support awslogs (logging to
+          # CloudWatch).
+          execution_role_arn: execution_role.arn,
+        ).task_definition
+        task_definition_ref = AWS_AUTH_ECS_TASK_FAMILY
+      end
+
+      service = ecs_client.describe_services(
+        cluster: cluster_name,
+        services: [service_name],
+      ).services.first
+
+      if service && service.status.downcase == 'draining'
+        puts "Waiting for #{service_name} to drain"
+        ecs_client.wait_until(
+          :services_inactive, {
+            cluster: cluster.cluster_name,
+            services: [service_name],
+          },
+          delay: 5,
+          max_attempts: 36,
+        )
+        puts "... done."
+        service = nil
+      end
+      if service && service.status.downcase == 'inactive'
+        service = nil
+      end
+      if service
+        puts "Updating service with status #{service.status}"
+        service = ecs_client.update_service(
+          cluster: cluster_name,
+          service: service_name,
+          task_definition: task_definition_ref,
+        ).service
+      else
+        puts "Creating a new service"
+        vpc_config = {}
+        unless options[:ec2]
+          vpc_config[:assign_public_ip] = 'ENABLED'
+        end
+        service = ecs_client.create_service(
+          desired_count: 1,
+          service_name: service_name,
+          task_definition: task_definition_ref,
+          cluster: cluster_name,
+          launch_type: launch_type,
+          network_configuration: {
+            awsvpc_configuration: vpc_config.merge(
+              subnets: subnet_ids,
+              security_groups: [security_group_id],
+            ),
+          },
+        ).service
+      end
+    end
+
+    def wait_for_ecs_ready(
+      cluster_name: AWS_AUTH_ECS_CLUSTER_NAME,
+      service_name: AWS_AUTH_ECS_SERVICE_NAME,
+      timeout: 20
+    )
+      deadline = Time.now + timeout
+
+      # The AWS SDK waiter seems to immediately fail sometimes right after
+      # the service is created, so wait for the service to become active
+      # manually and then use the waiter to wait for the service to become
+      # stable.
+      #
+      # The failure may be due to the fact that apparently, it is possible for
+      # describe_services to not return an existing service for some time.
+      # Therefore, allow the lack of service to be a transient error.
+      loop do
+        service = ecs_client.describe_services(
+          cluster: cluster_name,
+          services: [service_name],
+        ).services.first
+
+        if service.nil?
+          puts "Service #{service_name} in cluster #{cluster_name} does not exist (yet?)"
+          status = 'MISSING'
+        elsif service.status.downcase == 'active'
+          break
+        else
+          status = service.status
+        end
+
+        now = Time.now
+        if now >= deadline
+          raise "Service #{service_name} in cluster #{cluster_name} did not become ready in #{timeout} seconds (current status: #{status})"
+        end
+
+        puts "Wating for service #{service_name} in cluster #{cluster_name} to become ready (#{'%2.1f' % (deadline - now)} seconds remaining, current status: #{status})"
+        sleep 5
+      end
+
+      puts "Wating for service #{service_name} in cluster #{cluster_name} to become stable"
+      ecs_client.wait_until(
+        :services_stable, {
+          cluster: cluster_name,
+          services: [service_name],
+        },
+        delay: 5,
+        max_attempts: 36,
+      )
+    end
+
+    def terminate_auth_ecs_task
+      ecs_client.describe_services(
+        cluster: AWS_AUTH_ECS_CLUSTER_NAME,
+        services: [AWS_AUTH_ECS_SERVICE_NAME],
+      ).each do |resp|
+        resp.services.each do |service|
+          puts "Terminating #{service.service_name}"
+          begin
+            ecs_client.update_service(
+              cluster: AWS_AUTH_ECS_CLUSTER_NAME,
+              service: service.service_name,
+              desired_count: 0,
+            )
+          rescue Aws::ECS::Errors::ServiceNotActiveException
+            # No action needed
+          end
+          ecs_client.delete_service(
+            cluster: AWS_AUTH_ECS_CLUSTER_NAME,
+            service: service.service_name,
+          )
+        end
+      end
+    end
+
+    private
+
+    def find_running_instance(reservations)
+      instance = nil
+      reservations.each do |reservation|
+        instance = reservation.instances.detect do |instance|
+          %w(pending running stopped).include?(instance.state.name)
+        end
+        break if instance
+      end
+      instance
+    end
+  end
+end

data/spec/support/aws_utils/provisioner.rb

@@ -0,0 +1,360 @@
+module AwsUtils
+  class Provisioner < Base
+
+    def setup_aws_auth_resources
+      security_group_id = ssh_security_group_id
+      if security_group_id.nil?
+        security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+        ).group_id
+      end
+      puts "EC2 Security group: #{security_group_id}"
+      setup_security_group(security_group_id)
+
+      vpc = ec2_client.describe_vpcs(
+        filters: [{
+          name: 'cidr',
+          values: [AWS_AUTH_VPC_CIDR],
+        }],
+      ).vpcs.first
+      if vpc.nil?
+        vpc = ec2_client.create_vpc(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+        ).vpc
+      end
+
+      # The VPC must have an internet gateway and the subnet in the VPC
+      # must have a route to the internet gateway.
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#d0e22943
+      # Internet gateways cannot be named when they are created, therefore
+      # we check if our VPC has a gateway and if not, create an unnamed one
+      # and attach it right away.
+      # https://aws.amazon.com/premiumsupport/knowledge-center/ecs-pull-container-error/
+      igw = ec2_client.describe_internet_gateways(
+        filters: [{
+          name: 'attachment.vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).internet_gateways.first
+      if igw.nil?
+        igw = ec2_client.create_internet_gateway.internet_gateway
+        ec2_client.attach_internet_gateway(
+          internet_gateway_id: igw.internet_gateway_id,
+          vpc_id: vpc.vpc_id,
+        )
+      end
+
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#Add_IGW_Routing
+      route_table = ec2_client.describe_route_tables(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).route_tables.first
+      ec2_client.create_route(
+        destination_cidr_block: '0.0.0.0/0',
+        gateway_id: igw.internet_gateway_id,
+        route_table_id: route_table.route_table_id,
+      )
+
+      vpc_security_group_id = ssh_vpc_security_group_id
+      if vpc_security_group_id.nil?
+        vpc_security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_VPC_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+          vpc_id: vpc.vpc_id,
+        ).group_id
+      end
+      setup_security_group(vpc_security_group_id)
+
+      subnet = ec2_client.describe_subnets(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).subnets.first
+      if subnet.nil?
+        subnet = ec2_client.create_subnet(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+          vpc_id: vpc.vpc_id,
+        ).subnet
+      end
+      puts "VPC: #{vpc.vpc_id}, subnet: #{subnet.subnet_id}, security group: #{vpc_security_group_id}"
+
+      # For testing regular credentials, create an IAM user with no permissions.
+
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        resp = iam_client.create_user(
+          user_name: AWS_AUTH_REGULAR_USER_NAME,
+        )
+        user = resp.user
+      end
+
+      puts "Regular AWS auth unprivileged user: #{user.arn}"
+
+      # Assume role testing
+      # https://aws.amazon.com/premiumsupport/knowledge-center/iam-assume-role-cli/
+      #
+      # The instructions given in the above guide create an intermediate user
+      # who has the ability to assume the role. This script reuses the
+      # regular unprivileged user to be the user that assumes the role.
+      user_policy = detect_object(iam_client.list_policies, :policies, :policy_name, AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME)
+      if user_policy.nil?
+        user_policy_document = {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": [
+                "ec2:Describe*",
+                "iam:ListRoles",
+                "sts:AssumeRole",
+              ],
+              "Resource": "*",
+            },
+          ],
+        }
+        user_policy = iam_client.create_policy(
+          policy_name: AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME,
+          policy_document: user_policy_document.to_json,
+        ).policy
+      end
+
+      iam_client.attach_user_policy(
+        policy_arn: user_policy.arn,
+        user_name: user.user_name,
+      )
+
+      assume_role = detect_object(iam_client.list_roles, :roles, :role_name, AWS_AUTH_ASSUME_ROLE_NAME)
+      if assume_role.nil?
+        aws_account_id = user.arn.split(':')[4]
+        assume_role_policy = {
+          "Version": "2012-10-17",
+          "Statement": {
+            "Effect": "Allow",
+            "Principal": { "AWS": "arn:aws:iam::#{aws_account_id}:root" },
+            "Action": "sts:AssumeRole",
+          },
+        }
+        resp = iam_client.create_role(
+          role_name: AWS_AUTH_ASSUME_ROLE_NAME,
+          assume_role_policy_document: assume_role_policy.to_json,
+          max_session_duration: 12*3600,
+        )
+        assume_role = resp.role
+      end
+      puts "Assume role ARN: #{assume_role.arn}"
+
+      # For testing retrieval of credentials from EC2 link local endpoint,
+      # create an instance profile.
+      ips = iam_client.list_instance_profiles
+      instance_profile = ips.instance_profiles.detect do |instance_profile|
+        instance_profile.instance_profile_name == AWS_AUTH_INSTANCE_PROFILE_NAME
+      end
+      if instance_profile.nil?
+        resp = iam_client.create_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        )
+        instance_profile = resp.instance_profile
+      end
+
+      puts "EC2 instance profile: #{instance_profile.arn}"
+
+      # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#create-iam-role
+      assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": {
+          "Effect": "Allow",
+          "Principal": {"Service": "ec2.amazonaws.com"},
+          "Action": "sts:AssumeRole",
+        },
+      }
+      ec2_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "ec2:Describe*",
+            ],
+            "Resource": "*",
+          },
+        ],
+      }
+      ec2_role = create_role_with_policy(
+        AWS_AUTH_EC2_ROLE_NAME,
+        {
+          assume_role_policy_document: assume_role_policy_document.to_json,
+        },
+        ec2_role_policy_document,
+      )
+      puts "EC2 role ARN: #{ec2_role.arn}"
+
+      instance_profile.roles.each do |role|
+        iam_client.remove_role_from_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+          role_name: role.role_name,
+        )
+      end
+
+      iam_client.add_role_to_instance_profile(
+        instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        role_name: AWS_AUTH_EC2_ROLE_NAME,
+      )
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_AWSCLI_Fargate.html
+      puts "ECS cluster name: #{AWS_AUTH_ECS_CLUSTER_NAME}"
+      resp = ecs_client.describe_clusters(
+        clusters: [AWS_AUTH_ECS_CLUSTER_NAME],
+      )
+      cluster = detect_object(resp, :clusters, :cluster_name, AWS_AUTH_ECS_CLUSTER_NAME)
+      if cluster.nil?
+        resp = ecs_client.create_cluster(
+          cluster_name: AWS_AUTH_ECS_CLUSTER_NAME,
+        )
+        cluster = resp.cluster
+      end
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      ecs_assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Sid": "",
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "ecs-tasks.amazonaws.com",
+            },
+            "Action": "sts:AssumeRole",
+          },
+        ],
+      }
+
+      # The task role itself does not have any permissions.
+      # The example given in https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      # allows read-only access to an S3 bucket.
+      ecs_task_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [],
+      }
+      ecs_task_role = create_role_with_policy(
+        AWS_AUTH_ECS_TASK_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+      )
+
+      # Logging to CloudWatch:
+      # https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html
+      ecs_execution_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents",
+            "logs:DescribeLogStreams",
+          ],
+          "Resource": [
+            "*"
+          ],
+        }],
+      }
+      ecs_execution_role = create_role_with_policy(
+        AWS_AUTH_ECS_EXECUTION_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+        ecs_execution_role_policy_document,
+      )
+
+=begin
+      iam_client.attach_role_policy(
+        role_name: AWS_AUTH_ECS_ROLE_NAME,
+        policy_arn: "arn:aws:iam::aws:policy/AmazonECSTaskExecutionRolePolicy",
+      )
+=end
+
+      log_group = logs_client.describe_log_groups(
+        log_group_name_prefix: AWS_AUTH_ECS_LOG_GROUP,
+      ).log_groups.first
+      unless log_group
+        logs_client.create_log_group(
+          log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        )
+      end
+
+      logs_client.put_retention_policy(
+        log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        retention_in_days: 1,
+      )
+    end
+
+    def reset_keys
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        raise 'No user found, please run `aws setup-resources`'
+      end
+
+      iam_client.list_access_keys(
+        user_name: user.user_name,
+      ).to_h[:access_key_metadata].each do |access_key|
+        iam_client.delete_access_key(
+          user_name: user.user_name,
+          access_key_id: access_key[:access_key_id],
+        )
+      end
+
+      resp = iam_client.create_access_key(
+        user_name: user.user_name,
+      )
+      access_key = resp.to_h[:access_key]
+
+      puts "Credentials for regular user (#{AWS_AUTH_REGULAR_USER_NAME}):"
+      puts "AWS_ACCESS_KEY_ID=#{access_key[:access_key_id]}"
+      puts "AWS_SECRET_ACCESS_KEY=#{access_key[:secret_access_key]}"
+      puts
+    end
+
+    private
+
+    def create_role_with_policy(role_name, role_options, role_policy_document = nil)
+      role = detect_object(iam_client.list_roles, :roles, :role_name, role_name)
+      if role.nil?
+        resp = iam_client.create_role({
+          role_name: role_name,
+        }.update(role_options))
+        role = resp.role
+      end
+
+      if role_policy_document
+        iam_client.put_role_policy(
+          role_name: role_name,
+          policy_name: "#{role_name}.policy",
+          policy_document: role_policy_document.to_json,
+        )
+      end
+
+      role
+    end
+
+    def setup_security_group(security_group_id)
+      ec2_client.authorize_security_group_ingress(
+        group_id: security_group_id,
+        ip_permissions: [{
+          from_port: 22,
+          to_port: 22,
+          ip_protocol: 'tcp',
+          ip_ranges: [{
+            cidr_ip: '0.0.0.0/0',
+          }],
+        }],
+      )
+    rescue Aws::EC2::Errors::InvalidPermissionDuplicate
+    end
+  end
+end