https://github.com/jmoney/security-group-ingress

AWS Lambda written in go that manages security group ingress rules for public CDN.
https://github.com/jmoney/security-group-ingress

aws github-site license-management mkdocs

Last synced: about 2 months ago
JSON representation

AWS Lambda written in go that manages security group ingress rules for public CDN.

• Host: GitHub
• URL: https://github.com/jmoney/security-group-ingress
• Owner: jmoney
• License: apache-2.0
• Created: 2021-01-30T18:32:51.000Z (almost 4 years ago)
• Default Branch: main
• Last Pushed: 2024-01-01T03:03:39.000Z (about 1 year ago)
• Last Synced: 2024-11-24T20:07:29.581Z (2 months ago)
• Topics: aws, github-site, license-management, mkdocs
• Language: Go
• Homepage: https://www.jmoney.dev/security-group-ingress/
• Size: 5.92 MB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Security Group Ingress

## Overview

There are three components to the ingress manager.

1. Cloudwatch Event Trigger

2. Lambda

3. Security Group

![security-group-ingress](./docs/img/securitygroup-ingress.png)

The cloudwatch event trigger is exactly what one would think, it fires an event every 1 day that triggering a lambda.

The lambda is a basic extract, transform, and load(ETL) process.  The extract phase extracts IPs from two sources.

Source #1 is the public IP source. This is the source of truth list.  Source #2 is the security group ingress rules.

The ingress rules is what is actually being allowed.  The Lambda then transforms these two lists into two other lists.

List #1 is a left outer join to determine which IPs need to be added.  List #2 is a right outer join to determine

which IPs need to be removed.  Finally, the last phase is the load phase.  The lambda takes the IPs to be added and

authorizes them on the security group and takes the iPs to be removed and revokes them on the security group.

The lambda currently only manages ipv4 ingress and not the ipv6 ingress.

## Testing

```bash

go test -v ./...

```