terrafying-components 1.15.4 → 1.15.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7d362211008d95a4bd62f5181a67c1d4dad0a2316da9883cfb6aa59a4c2038c0
-  data.tar.gz: d6db4b592001e08129dcb29c47b8e80a350c2fb935351a5e1f4cec091770902d
+  metadata.gz: d47e66e01ef3a7fd52fc4c6d43bb4bda04d8095aae9e8c89261a4c41398db523
+  data.tar.gz: 2a78dcc08032da37b592f993dfdce10fe590207fb01e67a833f86b613cda3f2f
 SHA512:
-  metadata.gz: c61093528dbaa6eb9879d036960137e31fcbf1703ccfe170409b4d12f47d3340468fde524cd302546bde7e186d37a2f3427153dd6a1774246a80dab868c7a779
-  data.tar.gz: 518ce60a8c157293057ef5b0e4430046b2573707fc4c69c2341cf3d8b4eebda7c75ba9bc327c18f3c9b67ef2b3c8f8cf2001bc619baf16f0e8bb5d7e114f4ea9
+  metadata.gz: f19da72ffd9e97c6e7f56bd45b5bcaafd1a9457aa9df57b870f1731ade00569832f44b950145e638036296060312ecdd9dc20d9b934b753fe0676480d8ffce48
+  data.tar.gz: 7eee51612523adcfe49a29c853b9826cd28e9ba772ec24b259777eb8cbd886162ed7770cac4b0946ec377897939acfc724cd26e6a6cf384055687c20bf409fd3

data/lib/terrafying/components/dynamicset.rb

@@ -43,7 +43,8 @@ module Terrafying
           ssh_group: vpc.ssh_group,
           subnets: vpc.subnets.fetch(:private, []),
           depends_on: [],
-          rolling_update: :simple
+          rolling_update: :simple,
+          vpc_endpoints_egress: []
         }.merge(options)
 
         ident = "#{tf_safe(vpc.name)}-#{name}"
@@ -57,7 +58,12 @@ module Terrafying
                                    tags: options[:tags],
                                    vpc_id: vpc.id
 
-        default_egress_rule(ident, @security_group)
+        vpc_endpoints_egress = options[:vpc_endpoints_egress]
+        if vpc_endpoints_egress.empty?
+          default_egress_rule(ident, @security_group)
+        else
+          vpc_endpoint_egress_rules(ident, @security_group, vpc, vpc_endpoints_egress)
+        end
 
         path_mtu_setup!
 
@@ -115,6 +121,24 @@ module Terrafying
         self
       end
 
+      def vpc_endpoint_egress_rules(ident, security_group, vpc, vpc_endpoints)
+        prefix_ids = vpc_endpoints.map do | e |
+          vpc_endpoint = data :aws_vpc_endpoint, "#{ident}-#{tf_safe(e)}", {
+            vpc_id: vpc.id,
+            service_name: e,
+          }
+          vpc_endpoint[:prefix_list_id]
+        end
+
+        resource :aws_security_group_rule, "#{ident}-vpc-endpoint-egress",
+                 security_group_id: security_group,
+                 type: 'egress',
+                 from_port: 0,
+                 to_port: 0,
+                 protocol: -1,
+                 prefix_list_ids: prefix_ids
+      end
+      
       def default_egress_rule(ident, security_group)
         resource :aws_security_group_rule, "#{ident}-default-egress",
                  security_group_id: security_group,

data/lib/terrafying/components/endpoint.rb

@@ -25,6 +25,7 @@ module Terrafying
           auto_accept: true,
           subnets: vpc.subnets.fetch(:private, []),
           private_dns: false,
+          vpc_endpoint_type: "Interface",
           tags: {}
         }.merge(options)
 
@@ -73,7 +74,7 @@ module Terrafying
         resource :aws_vpc_endpoint, ident,
                  vpc_id: vpc.id,
                  service_name: service_name,
-                 vpc_endpoint_type: 'Interface',
+                 vpc_endpoint_type: options[:vpc_endpoint_type],
                  security_group_ids: [@security_group],
                  auto_accept: options[:auto_accept],
                  subnet_ids: options[:subnets].map(&:id),

data/lib/terrafying/components/ignition.rb

@@ -71,6 +71,7 @@ module Terrafying
           volumes: [],
           files: [],
           units: [],
+          users: [],
           networkd_units: [],
           ssh_group: 'cloud',
           disable_update_engine: false,

data/lib/terrafying/components/security_group.rb

@@ -0,0 +1,30 @@
+require 'terrafying/components/usable'
+require 'terrafying'
+
+module Terrafying
+    module Components
+       class SecurityGroup < Terrafying::Context
+        include Usable
+        def self.create_in(vpc, name, ports:)
+            new.create_in(vpc, name, ports: ports)
+        end
+        
+        def create_in(vpc, name, ports:)
+            @name = name
+            @ports = ports
+            @security_group_ref = resource :aws_security_group, tf_safe(name),{
+
+                vpc_id: vpc.id,
+                name: name,
+                tags: {
+                    'Name' => name
+                  }
+            }
+            @security_group = @security_group_ref[:id]
+            self
+        end
+        
+       end         
+
+    end
+end

data/lib/terrafying/components/service.rb

@@ -54,12 +54,14 @@ module Terrafying
           units: [],
           files: [],
           tags: {},
+          users: [],
           ssh_group: vpc.ssh_group,
           subnets: vpc.subnets.fetch(:private, []),
           startup_grace_period: 300,
           depends_on: [],
           audit_role: "arn:aws:iam::#{aws.account_id}:role/auditd_logging",
-          metrics_ports: []
+          metrics_ports: [],
+          vpc_endpoints_egress: []
         }.merge(options)
 
         unless options[:audit_role].nil?

data/lib/terrafying/components/staticset.rb

@@ -49,7 +49,8 @@ module Terrafying
           tags: {},
           ssh_group: vpc.ssh_group,
           depends_on: [],
-          volumes: []
+          volumes: [],
+          vpc_endpoints_egress: []
         }.merge(options)
 
         ident = "#{tf_safe(vpc.name)}-#{name}"
@@ -62,9 +63,13 @@ module Terrafying
                                    description: "Describe the ingress and egress of the static set #{ident}",
                                    tags: options[:tags],
                                    vpc_id: vpc.id
-
-        default_egress_rule(ident, @security_group)
-
+        
+        vpc_endpoints_egress = options[:vpc_endpoints_egress]
+        if vpc_endpoints_egress.empty?
+          default_egress_rule(ident, @security_group)
+        else
+          vpc_endpoint_egress_rules(ident, @security_group, vpc, vpc_endpoints_egress)
+        end
         path_mtu_setup!
 
         @instances = options[:instances].map.with_index do |config, i|
@@ -114,6 +119,25 @@ module Terrafying
                  cidr_blocks: ['0.0.0.0/0']
       end
 
+
+      def vpc_endpoint_egress_rules(ident, security_group, vpc, vpc_endpoints)
+        prefix_ids = vpc_endpoints.map do | e |
+          vpc_endpoint = data :aws_vpc_endpoint, "#{ident}-#{tf_safe(e)}", {
+            vpc_id: vpc.id,
+            service_name: e,
+          }
+          vpc_endpoint[:prefix_list_id]
+        end
+
+        resource :aws_security_group_rule, "#{ident}-vpc-endpoint-egress",
+                 security_group_id: security_group,
+                 type: 'egress',
+                 from_port: 0,
+                 to_port: 0,
+                 protocol: -1,
+                 prefix_list_ids: prefix_ids
+      end
+
       def volume_for(name, instance, volume, tags)
         vol_opts = {
           availability_zone: instance.subnet.az,

data/lib/terrafying/components/templates/ignition.yaml

@@ -9,7 +9,10 @@ passwd:
       sshAuthorizedKeys:
         - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDlIRM5H4lz/t8PfiGptR8cWqVrD8NCwROZly1XuYooWiIdTinJAvkATdR54ic6YuNenoKOeqtTj0dkytbzi5xItBti6cqzHvFAOXhKzVCsR5n/Mdt2KPbp215pFS96yfsx/24Z4cGygXe24SEXv28KdWZ1nWQyUrlne9jMaB7n3cGzNaXOPy42l03/bAaflWoyD7gyyS9XHDuZkLxVrhtlO43UtIXL4IZzKTCy1cZdaabZxRsrSzHUp+/5p3fHYgcYmwyO0Y+W3TP6LRC2ebeQe0r4Rh1o83sRvcbmuG14Wk7wDVFtu0vjtwOflCsRHGRibep/rXvtqf1/bG3brQ9tAV3oIeZ4r4yPUZenwIfM2pQH3ElD3kqw+Pdh1la1QXb4FDxeEw29nLU1eQF6ggnp3gzJJDRQWRB/I2RjKje5M1NcKjn+8ZBG1PHBikaOkjMRkXzOb8JQxKcWmeuRHo/ZTh7oUDDMObAVej9K91eCP3Dtz5QqmL1+J4+7YCjoBOBPpX3J+mrkxHRHcJYEIyJF6/mNDtov09Vji7Rdd0j1A5CJ2fvcuuUGK0LUHMSEyzLKg830E8b/kIZrufWEsljqlcHrYCJAO/LYl77PFe6B/vNfZtyw4fI6juGDlZNYWYXLJ2c+poCS8+2o1KjCli1lV2BOAjDUKEJxQ9NAw6MxPQ== tom.booth@uswitch.com"
       groups: ["sudo", "docker"]
-
+    <% users.each do |user| %>
+    - name: "<%= user[:name] %>"
+      sshAuthorizedKeys: <%= Array(user[:sshkeys]) %>
+    <% end %>
 systemd:
   units:
     <% if disable_update_engine %>

data/lib/terrafying/components/version.rb

@@ -2,6 +2,6 @@
 
 module Terrafying
   module Components
-    VERSION = '1.15.4'
+    VERSION = '1.15.5'
   end
 end

data/lib/terrafying/components.rb

@@ -11,3 +11,4 @@ require 'terrafying/components/vpc'
 require 'terrafying/components/vpn'
 require 'terrafying/components/vpn_oidc'
 require 'terrafying/components/zone'
+require 'terrafying/components/security_group'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: terrafying-components
 version: !ruby/object:Gem::Version
-  version: 1.15.4
+  version: 1.15.5
 platform: ruby
 authors:
 - uSwitch Limited
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-22 00:00:00.000000000 Z
+date: 2020-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -109,6 +109,7 @@ files:
 - lib/terrafying/components/security/store.rb
 - lib/terrafying/components/security/trail.rb
 - lib/terrafying/components/security/vpc.rb
+- lib/terrafying/components/security_group.rb
 - lib/terrafying/components/selfsignedca.rb
 - lib/terrafying/components/service.rb
 - lib/terrafying/components/staticset.rb