Updated Mirroring code to handle multi-CIDR VPCs - Githubissues

arkime / aws-aio

Apache License 2.0

8 stars 3 forks source link

Updated Mirroring code to handle multi-CIDR VPCs #73

Closed chelma closed 1 year ago

chelma commented 1 year ago

Description

Updated Python and CDK code to correctly handle setting up mirroring for VPCs with multiple CIDRs
There's a limit for how many CIDRs we can support due to Traffic Mirror's limit on the number of rules a given filter can have. It's possible we could find a workaround if we discover this is a major user pain-point.

Tasks

https://github.com/arkime/aws-aio/issues/72

Testing

Updated unit tests
Set up a demo VPC with a single CIDR, ran add-vpc against it to set up capture, went into the AWS Console and added a second CIDR to it, then ran add-vpc again. Confirmed that the filter rules were updated appropriately. Screenshots below.

License

I confirm that this contribution is made under an Apache 2.0 license and that I have the authority necessary to make this contribution on behalf of its copyright owner.

awick commented 1 year ago

LGTM