Feat(Terraform): front door #222

angela-tran · 2022-11-30T16:44:25Z

Closes #208

This PR sets up a Front Door with a WAF policy to allow only a certain list of IP addresses.

Note there is some overlap with #213 since the whitelist is different per-environment.

Before merging:

Clean up manually created Front Door resources that were used to get a working configuration
Set TF_VAR_IP_ADDRESS_WHITELIST_DEV variable in Azure pipeline

After merging:

Update Benefits dev data migration to use front-door hostname in EligibilityVerifier API URL

Some reference material

make endpoint name more unique

remove ip restriction blocks from app service because for app services that integrate with a virtual network using service endpoints (such as the CDT-hosted Benefits client), requests will be routed through Azure's optimized backbone and will not use the app's list of outbound IP addresses.

only allow our Front Door and availability tests.

terraform/variables.tf

afeld

Nice work! Just one blocker; the rest are optional. Questions:

Thoughts about adding a bit of documentation around why we're using Front Door? Or sufficient to have this comment?
We are allowing the availability tests through, which is good… What do we think about having a smoke test to ensure other requests are not allowed? Could do this through a GitHub Action or Azure Pipeline task.

terraform/app_service.tf

afeld · 2022-12-02T16:33:54Z

terraform/front_door.tf

+resource "azurerm_cdn_frontdoor_origin_group" "main" {
+  name                     = local.front_door_name
+  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
+  session_affinity_enabled = true


Minor: Since (I don't think) we're using cookies, not sure this is necessary. Given there's only one origin, not sure it would make a difference anyway.

Suggested change

session_affinity_enabled = true

Done in f1bd673

afeld · 2022-12-02T16:35:45Z

terraform/front_door.tf

+  https_port                     = 443
+  origin_host_header             = azurerm_linux_web_app.main.default_hostname
+  certificate_name_check_enabled = true
+  priority                       = 1


Minor: The numbers above are all same as the defaults, so could be removed for brevity. Fine either way.

Done in 0c160c7

terraform/front_door.tf

angela-tran · 2022-12-05T20:18:03Z

Thoughts about adding a bit of documentation around why we're using Front Door? Or sufficient to have #208 (comment)?

I added a section to the README in 5e6f74e

angela-tran · 2022-12-05T20:18:36Z

We are allowing the availability tests through, which is good… What do we think about having a smoke test to ensure other requests are not allowed? Could do this through a GitHub Action or Azure Pipeline task.

Any objection to creating a new issue for this?

thekaveman

Left some questions - not necessarily required changes, but hoping for some additional clarity ahead of Approval.

terraform/front_door.tf

thekaveman · 2022-12-05T22:44:41Z

terraform/front_door.tf

+  enabled                           = true
+  mode                              = "Prevention"
+  custom_block_response_status_code = 403
+  custom_block_response_body        = base64encode("Blocked")


The term most often associated with 403 is Forbidden: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403

Done in 14a548b

thekaveman · 2022-12-05T22:46:49Z

terraform/front_door.tf

+
+    match_condition {
+      match_variable = "RequestUri"
+      operator       = "EndsWith"


This mean any request that ends with /healthcheck will go through, right?

Should we do an exact match here to shore up this one exception and make sure it is the only one? I think Equals is the operator for that: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cdn_frontdoor_firewall_policy#operator

It took me a bit to figure out what the Equals operator is matching against, but I got it to work. The match value needs to include the URI scheme, host, and port in addition to the path.

Done in f9b039d

terraform/front_door.tf

afeld

We currently have the uptime check accessing the App Service directly, not through Front Door. Thinking we should change it to the latter to make it end-to-end. This would remove the need for allowing those requests to the App Service, though not a big deal to leave them.

thekaveman · 2022-12-06T21:46:10Z

We currently have the uptime check accessing the App Service directly, not through Front Door. Thinking we should change it to the latter to make it end-to-end. This would remove the need for allowing those requests to the App Service, though not a big deal to leave them.

Seems like a good follow-up! #223

thekaveman

Looks like a great start, thank you @angela-tran! We can worry about deployment when you're back 😄

angela-tran · 2022-12-13T21:21:04Z

@afeld let me know if there's anything else to change here. This needs your approval before I can merge. Thanks!

angela-tran self-assigned this Nov 30, 2022

feat(terraform): create front door and origin group

2a0e24b

angela-tran force-pushed the feat/front-door branch from 844e2c2 to 2a0e24b Compare November 30, 2022 17:36

angela-tran added 4 commits November 30, 2022 22:13

refactor(terraform): simplify naming of front door resources

c4a8747

make endpoint name more unique

feat(terraform): add service-tag based access restrictions

3052d6f

only allow our Front Door and availability tests.

refactor(terraform): allow environment-specific ip whitelists

3ec759a

angela-tran commented Nov 30, 2022

View reviewed changes

terraform/variables.tf Show resolved Hide resolved

angela-tran added this to the Courtesy Cards milestone Nov 30, 2022

angela-tran marked this pull request as ready for review November 30, 2022 23:06

angela-tran requested a review from a team as a code owner November 30, 2022 23:06

afeld suggested changes Dec 2, 2022

View reviewed changes

afeld mentioned this pull request Dec 2, 2022

Extract reusable infrastructure components cal-itp/benefits#1038

Closed

1 task

angela-tran added 5 commits December 5, 2022 17:41

chore(terraform): remove unneeded setting on origin group

f1bd673

chore(terraform): remove origin settings that are just using defaults

0c160c7

feat(terraform): allow any IP address to access /healthcheck

5a28a9b

docs(uptime): add a comment to uptime module about access restrictions

17af406

docs(terraform): add docs on access restrictions / front door

5e6f74e

angela-tran requested review from afeld and thekaveman December 5, 2022 20:19

thekaveman reviewed Dec 5, 2022

View reviewed changes

afeld reviewed Dec 6, 2022

View reviewed changes

thekaveman mentioned this pull request Dec 6, 2022

Make availability/uptime check route through FrontDoor #223

Closed

chore(terraform): change custom block response body to match status code

14a548b

angela-tran mentioned this pull request Dec 6, 2022

Create a smoke test for IP restriction #224

Closed

angela-tran added 2 commits December 6, 2022 22:16

chore(terraform): add comment about empty load balancing block

8ed904e

refactor(terraform): make healthcheck custom rule allow exact path

f9b039d

angela-tran requested review from thekaveman and afeld December 6, 2022 22:31

thekaveman approved these changes Dec 6, 2022

View reviewed changes

afeld approved these changes Dec 13, 2022

View reviewed changes

angela-tran merged commit caa686c into dev Dec 13, 2022

angela-tran deleted the feat/front-door branch December 13, 2022 23:28

This was referenced Dec 13, 2022

fix(terraform): typo in custom rule operator #226

Merged

Fix: IP restriction custom rule #227

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat(Terraform): front door #222

Feat(Terraform): front door #222

angela-tran commented Nov 30, 2022 •

edited

Loading

afeld left a comment

afeld Dec 2, 2022 •

edited

Loading

angela-tran Dec 5, 2022

afeld Dec 2, 2022

angela-tran Dec 5, 2022

angela-tran commented Dec 5, 2022

angela-tran commented Dec 5, 2022

thekaveman left a comment

thekaveman Dec 5, 2022

angela-tran Dec 6, 2022

thekaveman Dec 5, 2022

angela-tran Dec 6, 2022

angela-tran Dec 6, 2022

afeld left a comment

thekaveman commented Dec 6, 2022

thekaveman left a comment

angela-tran commented Dec 13, 2022

Feat(Terraform): front door #222

Feat(Terraform): front door #222

Conversation

angela-tran commented Nov 30, 2022 • edited Loading

Before merging:

After merging:

Some reference material

afeld left a comment

Choose a reason for hiding this comment

afeld Dec 2, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

angela-tran commented Dec 5, 2022

angela-tran commented Dec 5, 2022

thekaveman left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

afeld left a comment

Choose a reason for hiding this comment

thekaveman commented Dec 6, 2022

thekaveman left a comment

Choose a reason for hiding this comment

angela-tran commented Dec 13, 2022

angela-tran commented Nov 30, 2022 •

edited

Loading

afeld Dec 2, 2022 •

edited

Loading