aws-cdk
Version:
CDK Toolkit, the command line tool for CDK apps
71 lines • 10.1 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.hasAllTrafficEgress = exports.SecurityGroupContextProviderPlugin = void 0;
const cxapi = require("@aws-cdk/cx-api");
const credentials_1 = require("../api/aws-auth/credentials");
class SecurityGroupContextProviderPlugin {
constructor(aws) {
this.aws = aws;
}
async getValue(args) {
const account = args.account;
const region = args.region;
if (args.securityGroupId && args.securityGroupName) {
throw new Error('\'securityGroupId\' and \'securityGroupName\' can not be specified both when looking up a security group');
}
if (!args.securityGroupId && !args.securityGroupName) {
throw new Error('\'securityGroupId\' or \'securityGroupName\' must be specified to look up a security group');
}
const options = { assumeRoleArn: args.lookupRoleArn };
const ec2 = (await this.aws.forEnvironment(cxapi.EnvironmentUtils.make(account, region), credentials_1.Mode.ForReading, options)).sdk.ec2();
const filters = [];
if (args.vpcId) {
filters.push({
Name: 'vpc-id',
Values: [args.vpcId],
});
}
if (args.securityGroupName) {
filters.push({
Name: 'group-name',
Values: [args.securityGroupName],
});
}
const response = await ec2.describeSecurityGroups({
GroupIds: args.securityGroupId ? [args.securityGroupId] : undefined,
Filters: filters.length > 0 ? filters : undefined,
}).promise();
const securityGroups = response.SecurityGroups ?? [];
if (securityGroups.length === 0) {
throw new Error(`No security groups found matching ${JSON.stringify(args)}`);
}
if (securityGroups.length > 1) {
throw new Error(`More than one security groups found matching ${JSON.stringify(args)}`);
}
const [securityGroup] = securityGroups;
return {
securityGroupId: securityGroup.GroupId,
allowAllOutbound: hasAllTrafficEgress(securityGroup),
};
}
}
exports.SecurityGroupContextProviderPlugin = SecurityGroupContextProviderPlugin;
/**
* @internal
*/
function hasAllTrafficEgress(securityGroup) {
let hasAllTrafficCidrV4 = false;
let hasAllTrafficCidrV6 = false;
for (const ipPermission of securityGroup.IpPermissionsEgress ?? []) {
const isAllProtocols = ipPermission.IpProtocol === '-1';
if (isAllProtocols && ipPermission.IpRanges?.some(m => m.CidrIp === '0.0.0.0/0')) {
hasAllTrafficCidrV4 = true;
}
if (isAllProtocols && ipPermission.Ipv6Ranges?.some(m => m.CidrIpv6 === '::/0')) {
hasAllTrafficCidrV6 = true;
}
}
return hasAllTrafficCidrV4 && hasAllTrafficCidrV6;
}
exports.hasAllTrafficEgress = hasAllTrafficEgress;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjdXJpdHktZ3JvdXBzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsic2VjdXJpdHktZ3JvdXBzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHlDQUF5QztBQUV6Qyw2REFBbUQ7QUFJbkQsTUFBYSxrQ0FBa0M7SUFDN0MsWUFBNkIsR0FBZ0I7UUFBaEIsUUFBRyxHQUFILEdBQUcsQ0FBYTtJQUM3QyxDQUFDO0lBRUQsS0FBSyxDQUFDLFFBQVEsQ0FBQyxJQUF3QztRQUNyRCxNQUFNLE9BQU8sR0FBVyxJQUFJLENBQUMsT0FBUSxDQUFDO1FBQ3RDLE1BQU0sTUFBTSxHQUFXLElBQUksQ0FBQyxNQUFPLENBQUM7UUFFcEMsSUFBSSxJQUFJLENBQUMsZUFBZSxJQUFJLElBQUksQ0FBQyxpQkFBaUIsRUFBRTtZQUNsRCxNQUFNLElBQUksS0FBSyxDQUFDLDBHQUEwRyxDQUFDLENBQUM7U0FDN0g7UUFFRCxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsSUFBSSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRTtZQUNwRCxNQUFNLElBQUksS0FBSyxDQUFDLDRGQUE0RixDQUFDLENBQUM7U0FDL0c7UUFFRCxNQUFNLE9BQU8sR0FBRyxFQUFFLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDdEQsTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxFQUFFLGtCQUFJLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBRTlILE1BQU0sT0FBTyxHQUF1QixFQUFFLENBQUM7UUFDdkMsSUFBSSxJQUFJLENBQUMsS0FBSyxFQUFFO1lBQ2QsT0FBTyxDQUFDLElBQUksQ0FBQztnQkFDWCxJQUFJLEVBQUUsUUFBUTtnQkFDZCxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO2FBQ3JCLENBQUMsQ0FBQztTQUNKO1FBQ0QsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEVBQUU7WUFDMUIsT0FBTyxDQUFDLElBQUksQ0FBQztnQkFDWCxJQUFJLEVBQUUsWUFBWTtnQkFDbEIsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDO2FBQ2pDLENBQUMsQ0FBQztTQUNKO1FBRUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxHQUFHLENBQUMsc0JBQXNCLENBQUM7WUFDaEQsUUFBUSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTO1lBQ25FLE9BQU8sRUFBRSxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTO1NBQ2xELENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUViLE1BQU0sY0FBYyxHQUFHLFFBQVEsQ0FBQyxjQUFjLElBQUksRUFBRSxDQUFDO1FBQ3JELElBQUksY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUU7WUFDL0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7U0FDOUU7UUFFRCxJQUFJLGNBQWMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFO1lBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0RBQWdELElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1NBQ3pGO1FBRUQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLGNBQWMsQ0FBQztRQUV2QyxPQUFPO1lBQ0wsZUFBZSxFQUFFLGFBQWEsQ0FBQyxPQUFRO1lBQ3ZDLGdCQUFnQixFQUFFLG1CQUFtQixDQUFDLGFBQWEsQ0FBQztTQUNyRCxDQUFDO0lBQ0osQ0FBQztDQUNGO0FBdERELGdGQXNEQztBQUVEOztHQUVHO0FBQ0gsU0FBZ0IsbUJBQW1CLENBQUMsYUFBb0M7SUFDdEUsSUFBSSxtQkFBbUIsR0FBRyxLQUFLLENBQUM7SUFDaEMsSUFBSSxtQkFBbUIsR0FBRyxLQUFLLENBQUM7SUFFaEMsS0FBSyxNQUFNLFlBQVksSUFBSSxhQUFhLENBQUMsbUJBQW1CLElBQUksRUFBRSxFQUFFO1FBQ2xFLE1BQU0sY0FBYyxHQUFHLFlBQVksQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDO1FBRXhELElBQUksY0FBYyxJQUFJLFlBQVksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsRUFBRTtZQUNoRixtQkFBbUIsR0FBRyxJQUFJLENBQUM7U0FDNUI7UUFFRCxJQUFJLGNBQWMsSUFBSSxZQUFZLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEtBQUssTUFBTSxDQUFDLEVBQUU7WUFDL0UsbUJBQW1CLEdBQUcsSUFBSSxDQUFDO1NBQzVCO0tBQ0Y7SUFFRCxPQUFPLG1CQUFtQixJQUFJLG1CQUFtQixDQUFDO0FBQ3BELENBQUM7QUFqQkQsa0RBaUJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY3hzY2hlbWEgZnJvbSAnQGF3cy1jZGsvY2xvdWQtYXNzZW1ibHktc2NoZW1hJztcbmltcG9ydCAqIGFzIGN4YXBpIGZyb20gJ0Bhd3MtY2RrL2N4LWFwaSc7XG5pbXBvcnQgKiBhcyBBV1MgZnJvbSAnYXdzLXNkayc7XG5pbXBvcnQgeyBNb2RlIH0gZnJvbSAnLi4vYXBpL2F3cy1hdXRoL2NyZWRlbnRpYWxzJztcbmltcG9ydCB7IFNka1Byb3ZpZGVyIH0gZnJvbSAnLi4vYXBpL2F3cy1hdXRoL3Nkay1wcm92aWRlcic7XG5pbXBvcnQgeyBDb250ZXh0UHJvdmlkZXJQbHVnaW4gfSBmcm9tICcuLi9hcGkvcGx1Z2luJztcblxuZXhwb3J0IGNsYXNzIFNlY3VyaXR5R3JvdXBDb250ZXh0UHJvdmlkZXJQbHVnaW4gaW1wbGVtZW50cyBDb250ZXh0UHJvdmlkZXJQbHVnaW4ge1xuICBjb25zdHJ1Y3Rvcihwcml2YXRlIHJlYWRvbmx5IGF3czogU2RrUHJvdmlkZXIpIHtcbiAgfVxuXG4gIGFzeW5jIGdldFZhbHVlKGFyZ3M6IGN4c2NoZW1hLlNlY3VyaXR5R3JvdXBDb250ZXh0UXVlcnkpOiBQcm9taXNlPGN4YXBpLlNlY3VyaXR5R3JvdXBDb250ZXh0UmVzcG9uc2U+IHtcbiAgICBjb25zdCBhY2NvdW50OiBzdHJpbmcgPSBhcmdzLmFjY291bnQhO1xuICAgIGNvbnN0IHJlZ2lvbjogc3RyaW5nID0gYXJncy5yZWdpb24hO1xuXG4gICAgaWYgKGFyZ3Muc2VjdXJpdHlHcm91cElkICYmIGFyZ3Muc2VjdXJpdHlHcm91cE5hbWUpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignXFwnc2VjdXJpdHlHcm91cElkXFwnIGFuZCBcXCdzZWN1cml0eUdyb3VwTmFtZVxcJyBjYW4gbm90IGJlIHNwZWNpZmllZCBib3RoIHdoZW4gbG9va2luZyB1cCBhIHNlY3VyaXR5IGdyb3VwJyk7XG4gICAgfVxuXG4gICAgaWYgKCFhcmdzLnNlY3VyaXR5R3JvdXBJZCAmJsKgIWFyZ3Muc2VjdXJpdHlHcm91cE5hbWUpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignXFwnc2VjdXJpdHlHcm91cElkXFwnIG9yIFxcJ3NlY3VyaXR5R3JvdXBOYW1lXFwnIG11c3QgYmUgc3BlY2lmaWVkIHRvIGxvb2sgdXAgYSBzZWN1cml0eSBncm91cCcpO1xuICAgIH1cblxuICAgIGNvbnN0IG9wdGlvbnMgPSB7IGFzc3VtZVJvbGVBcm46IGFyZ3MubG9va3VwUm9sZUFybiB9O1xuICAgIGNvbnN0IGVjMiA9IChhd2FpdCB0aGlzLmF3cy5mb3JFbnZpcm9ubWVudChjeGFwaS5FbnZpcm9ubWVudFV0aWxzLm1ha2UoYWNjb3VudCwgcmVnaW9uKSwgTW9kZS5Gb3JSZWFkaW5nLCBvcHRpb25zKSkuc2RrLmVjMigpO1xuXG4gICAgY29uc3QgZmlsdGVyczogQVdTLkVDMi5GaWx0ZXJMaXN0ID0gW107XG4gICAgaWYgKGFyZ3MudnBjSWQpIHtcbiAgICAgIGZpbHRlcnMucHVzaCh7XG4gICAgICAgIE5hbWU6ICd2cGMtaWQnLFxuICAgICAgICBWYWx1ZXM6IFthcmdzLnZwY0lkXSxcbiAgICAgIH0pO1xuICAgIH1cbiAgICBpZiAoYXJncy5zZWN1cml0eUdyb3VwTmFtZSkge1xuICAgICAgZmlsdGVycy5wdXNoKHtcbiAgICAgICAgTmFtZTogJ2dyb3VwLW5hbWUnLFxuICAgICAgICBWYWx1ZXM6IFthcmdzLnNlY3VyaXR5R3JvdXBOYW1lXSxcbiAgICAgIH0pO1xuICAgIH1cblxuICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgZWMyLmRlc2NyaWJlU2VjdXJpdHlHcm91cHMoe1xuICAgICAgR3JvdXBJZHM6IGFyZ3Muc2VjdXJpdHlHcm91cElkID8gW2FyZ3Muc2VjdXJpdHlHcm91cElkXSA6IHVuZGVmaW5lZCxcbiAgICAgIEZpbHRlcnM6IGZpbHRlcnMubGVuZ3RoID4gMCA/IGZpbHRlcnMgOiB1bmRlZmluZWQsXG4gICAgfSkucHJvbWlzZSgpO1xuXG4gICAgY29uc3Qgc2VjdXJpdHlHcm91cHMgPSByZXNwb25zZS5TZWN1cml0eUdyb3VwcyA/PyBbXTtcbiAgICBpZiAoc2VjdXJpdHlHcm91cHMubGVuZ3RoID09PSAwKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYE5vIHNlY3VyaXR5IGdyb3VwcyBmb3VuZCBtYXRjaGluZyAke0pTT04uc3RyaW5naWZ5KGFyZ3MpfWApO1xuICAgIH1cblxuICAgIGlmIChzZWN1cml0eUdyb3Vwcy5sZW5ndGggPiAxKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYE1vcmUgdGhhbiBvbmUgc2VjdXJpdHkgZ3JvdXBzIGZvdW5kIG1hdGNoaW5nICR7SlNPTi5zdHJpbmdpZnkoYXJncyl9YCk7XG4gICAgfVxuXG4gICAgY29uc3QgW3NlY3VyaXR5R3JvdXBdID0gc2VjdXJpdHlHcm91cHM7XG5cbiAgICByZXR1cm4ge1xuICAgICAgc2VjdXJpdHlHcm91cElkOiBzZWN1cml0eUdyb3VwLkdyb3VwSWQhLFxuICAgICAgYWxsb3dBbGxPdXRib3VuZDogaGFzQWxsVHJhZmZpY0VncmVzcyhzZWN1cml0eUdyb3VwKSxcbiAgICB9O1xuICB9XG59XG5cbi8qKlxuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBoYXNBbGxUcmFmZmljRWdyZXNzKHNlY3VyaXR5R3JvdXA6IEFXUy5FQzIuU2VjdXJpdHlHcm91cCkge1xuICBsZXQgaGFzQWxsVHJhZmZpY0NpZHJWNCA9IGZhbHNlO1xuICBsZXQgaGFzQWxsVHJhZmZpY0NpZHJWNiA9IGZhbHNlO1xuXG4gIGZvciAoY29uc3QgaXBQZXJtaXNzaW9uIG9mIHNlY3VyaXR5R3JvdXAuSXBQZXJtaXNzaW9uc0VncmVzcyA/PyBbXSkge1xuICAgIGNvbnN0IGlzQWxsUHJvdG9jb2xzID0gaXBQZXJtaXNzaW9uLklwUHJvdG9jb2wgPT09ICctMSc7XG5cbiAgICBpZiAoaXNBbGxQcm90b2NvbHMgJiYgaXBQZXJtaXNzaW9uLklwUmFuZ2VzPy5zb21lKG0gPT4gbS5DaWRySXAgPT09ICcwLjAuMC4wLzAnKSkge1xuICAgICAgaGFzQWxsVHJhZmZpY0NpZHJWNCA9IHRydWU7XG4gICAgfVxuXG4gICAgaWYgKGlzQWxsUHJvdG9jb2xzICYmIGlwUGVybWlzc2lvbi5JcHY2UmFuZ2VzPy5zb21lKG0gPT4gbS5DaWRySXB2NiA9PT0gJzo6LzAnKSkge1xuICAgICAgaGFzQWxsVHJhZmZpY0NpZHJWNiA9IHRydWU7XG4gICAgfVxuICB9XG5cbiAgcmV0dXJuIGhhc0FsbFRyYWZmaWNDaWRyVjQgJiYgaGFzQWxsVHJhZmZpY0NpZHJWNjtcbn1cbiJdfQ==