ALB Security Group

[afgallo]

I am aware I can lock down my ALB by using this configuration setting.

The idea is to use a Cloudfront instance as a CDN and "reverse proxy".

It seems that a better approach would be to leverage this Managed Prefix List as IPs are already listed and managed by AWS:

Is this possible? How can I achieve this, using an add-on?

Thanks!

[efekarakus]

Hi @afgallo 👋 !

How do you create the CloudFront distribution today?

It seems that a better approach would be to leverage this Managed Prefix List as IPs are already listed and managed by AWS:

Yes that's definitely the better approach. We're actively working on #3522 which will make it possible for you to adjust the security group settings of the load balancer.
Unfortunately, until then I can't think of a nice solution besides modifying the security group of the load balancer outside of Copilot (on the console or through the AWS CLI) 🙇

[afgallo]

Thanks, @efekarakus. We create our CloudFront distribution via an add-on today.

It's good to know this is in the roadmap and hopefully be release soon. Any ETA on that?

Unfortunately, until then I can't think of a nice solution besides modifying the security group of the load balancer outside of Copilot (on the console or through the AWS CLI) 🙇

I was wondering if there was a workaround via add-ons but apparently not. We try to avoid manual changes (even if it's scripted) to the stack as all we do is IaC!

[efekarakus]

Any ETA on that?

We're expecting the environment manifest to land in the next release. ETA late July.

I was wondering if there was a workaround via add-ons but apparently not. We try to avoid manual changes (even if it's scripted) to the stack as all we do is IaC!

Totally makes sense!
Really not ideal, but until then a way of mitigating it might be by writing a custom resource backed by Lambda

CustomResourceRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: 2012-10-17
      Statement:
        -
          Effect: Allow
          Principal:
            Service:
              - lambda.amazonaws.com
          Action:
            - sts:AssumeRole
    Path: /
    Policies:
      - PolicyName: "Modify EC2 security groups"
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - ec2:DescribeSecurityGroups
              Resource:
                - "*"
            - Effect: Allow
              Action:
                - ec2:AuthorizeSecurityGroupIngress
                - ec2:RevokeSecurityGroupIngress
              Resource:
                - "*"
              Condition:
                StringEquals:
                   'aws:ResourceTag/copilot-application': !Sub '${App}'
                   'aws:ResourceTag/copilot-environment': !Sub '${Env}' 

CloudFrontIngressAction:
  Type: Custom::CloudFrontIngressFunction
  DependsOn:
  - CloudFrontIngressFunction
  Properties:
    ServiceToken: !GetAtt CloudFrontIngressFunction.Arn

CloudFrontIngressFunction:
  Type: AWS::Lambda::Function
  Properties:
     Code:
        ZipFile: |
          // Code that describes the security group, add CloudFront ingress, and removes existing ingresses.
    Handler: "index.handler"
    Timeout: 900
    MemorySize: 512
    Role: !GetAtt 'CustomResourceRole.Arn'
    Runtime: nodejs12.x