search

rapid7 / builderator

Tools to make CI Packer builds awesome
MIT License
23 stars 9 forks source link

Create security group with tight ssh permissions #116

Closed rdickey-r7 closed 7 years ago

rdickey-r7 commented 7 years ago

By default, if you don't specify a security group, packer will create a security group with port 22 (ssh) open to the world. This is suboptimal, as this level of openness is unnecessary.

Now, if no security group is specified by the Buildfile, builderator will create one with port 22 only open to the external IP of the system on which builderator is being run, as determined by Amazon's external ip lookup service. After bake is complete (successfully or not, barring certain exceptions within ruby) the security group is deleted.

This design is similar to packer's default behavior, except that it locks the security group down to only give the access necessary.

erran-r7 commented 7 years ago

The following error is in [at least one] of the PR builds:

Failure/Error: clients["ec2-#{region}"] ||= Aws::EC2::Client.new(options)

Aws::Errors::MissingRegionError:
  missing region; use :region option or export region name to ENV['AWS_REGION']