Skip to content

Commit 89c47b3

Browse files
Brian969Brian969
authored
Latest config samples tweaks (#774)
* tweak-configs - auto-scale instance refresh reduced to 7 days from 30 - fix perimeter alb target group configurations - align all example config files * fix ami versions * repush test config * protect ASEA deployed net constructs in Sandbox
1 parent ab4faf0 commit 89c47b3

File tree

5 files changed

+57
-129
lines changed

5 files changed

+57
-129
lines changed

‎reference-artifacts/SAMPLE_CONFIGS/config.example.json‎

Lines changed: 6 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,7 +1067,7 @@
10671067
"num-rdgw-hosts": 1,
10681068
"min-rdgw-hosts": 1,
10691069
"max-rdgw-hosts": 2,
1070-
"rdgw-max-instance-age": 30,
1070+
"rdgw-max-instance-age": 7,
10711071
"rdgw-instance-type": "t2.large",
10721072
"rdgw-instance-role": "${ACCELERATOR_PREFIX_ND}-RDGW-Role",
10731073
"password-policies": {
@@ -1173,7 +1173,7 @@
11731173
"rsyslog-instance-type": "t2.large",
11741174
"rsyslog-instance-role": "${ACCELERATOR_PREFIX_ND}-Rsyslog-Role",
11751175
"rsyslog-root-volume-size": 100,
1176-
"rsyslog-max-instance-age": 30
1176+
"rsyslog-max-instance-age": 7
11771177
}
11781178
}
11791179
},
@@ -1258,7 +1258,7 @@
12581258
"access-logs": true,
12591259
"targets": [
12601260
{
1261-
"target-name": "FG1-Web-azA",
1261+
"target-name": "Firewalls",
12621262
"target-type": "instance",
12631263
"protocol": "HTTPS",
12641264
"port": 7001,
@@ -1271,20 +1271,7 @@
12711271
"target": "firewall",
12721272
"name": "Firewall",
12731273
"az": "a"
1274-
}
1275-
],
1276-
"tg-weight": 1
1277-
},
1278-
{
1279-
"target-name": "FG1-Web-azB",
1280-
"target-type": "instance",
1281-
"protocol": "HTTPS",
1282-
"port": 7001,
1283-
"health-check-protocol": "HTTPS",
1284-
"health-check-path": "/health-check",
1285-
"health-check-port": 7001,
1286-
"lambda-filename": "",
1287-
"target-instances": [
1274+
},
12881275
{
12891276
"target": "firewall",
12901277
"name": "Firewall",
@@ -1318,7 +1305,7 @@
13181305
"access-logs": true,
13191306
"targets": [
13201307
{
1321-
"target-name": "FG1-Web-azA",
1308+
"target-name": "Firewalls",
13221309
"target-type": "instance",
13231310
"protocol": "HTTPS",
13241311
"port": 7002,
@@ -1331,20 +1318,7 @@
13311318
"target": "firewall",
13321319
"name": "Firewall",
13331320
"az": "a"
1334-
}
1335-
],
1336-
"tg-weight": 1
1337-
},
1338-
{
1339-
"target-name": "FG1-Web-azB",
1340-
"target-type": "instance",
1341-
"protocol": "HTTPS",
1342-
"port": 7002,
1343-
"health-check-protocol": "HTTPS",
1344-
"health-check-path": "/health-check",
1345-
"health-check-port": 7001,
1346-
"lambda-filename": "",
1347-
"target-instances": [
1321+
},
13481322
{
13491323
"target": "firewall",
13501324
"name": "Firewall",

‎reference-artifacts/SAMPLE_CONFIGS/config.lite-example.json‎

Lines changed: 6 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1007,7 +1007,7 @@
10071007
"num-rdgw-hosts": 1,
10081008
"min-rdgw-hosts": 1,
10091009
"max-rdgw-hosts": 2,
1010-
"rdgw-max-instance-age": 30,
1010+
"rdgw-max-instance-age": 7,
10111011
"rdgw-instance-type": "t2.large",
10121012
"rdgw-instance-role": "${ACCELERATOR_PREFIX_ND}-RDGW-Role",
10131013
"password-policies": {
@@ -1113,7 +1113,7 @@
11131113
"rsyslog-instance-type": "t2.large",
11141114
"rsyslog-instance-role": "${ACCELERATOR_PREFIX_ND}-Rsyslog-Role",
11151115
"rsyslog-root-volume-size": 100,
1116-
"rsyslog-max-instance-age": 30
1116+
"rsyslog-max-instance-age": 7
11171117
}
11181118
}
11191119
},
@@ -1198,7 +1198,7 @@
11981198
"access-logs": true,
11991199
"targets": [
12001200
{
1201-
"target-name": "FG1-Web-azA",
1201+
"target-name": "Firewalls",
12021202
"target-type": "instance",
12031203
"protocol": "HTTPS",
12041204
"port": 7001,
@@ -1211,20 +1211,7 @@
12111211
"target": "firewall",
12121212
"name": "Firewall",
12131213
"az": "a"
1214-
}
1215-
],
1216-
"tg-weight": 1
1217-
},
1218-
{
1219-
"target-name": "FG1-Web-azB",
1220-
"target-type": "instance",
1221-
"protocol": "HTTPS",
1222-
"port": 7001,
1223-
"health-check-protocol": "HTTPS",
1224-
"health-check-path": "/health-check",
1225-
"health-check-port": 7001,
1226-
"lambda-filename": "",
1227-
"target-instances": [
1214+
},
12281215
{
12291216
"target": "firewall",
12301217
"name": "Firewall",
@@ -1258,7 +1245,7 @@
12581245
"access-logs": true,
12591246
"targets": [
12601247
{
1261-
"target-name": "FG1-Web-azA",
1248+
"target-name": "Firewalls",
12621249
"target-type": "instance",
12631250
"protocol": "HTTPS",
12641251
"port": 7002,
@@ -1271,20 +1258,7 @@
12711258
"target": "firewall",
12721259
"name": "Firewall",
12731260
"az": "a"
1274-
}
1275-
],
1276-
"tg-weight": 1
1277-
},
1278-
{
1279-
"target-name": "FG1-Web-azB",
1280-
"target-type": "instance",
1281-
"protocol": "HTTPS",
1282-
"port": 7002,
1283-
"health-check-protocol": "HTTPS",
1284-
"health-check-path": "/health-check",
1285-
"health-check-port": 7001,
1286-
"lambda-filename": "",
1287-
"target-instances": [
1261+
},
12881262
{
12891263
"target": "firewall",
12901264
"name": "Firewall",

‎reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json‎

Lines changed: 6 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1276,7 +1276,7 @@
12761276
"num-rdgw-hosts": 1,
12771277
"min-rdgw-hosts": 1,
12781278
"max-rdgw-hosts": 2,
1279-
"rdgw-max-instance-age": 30,
1279+
"rdgw-max-instance-age": 7,
12801280
"rdgw-instance-type": "t2.large",
12811281
"rdgw-instance-role": "${ACCELERATOR_PREFIX_ND}-RDGW-Role",
12821282
"password-policies": {
@@ -1382,7 +1382,7 @@
13821382
"rsyslog-instance-type": "t2.large",
13831383
"rsyslog-instance-role": "${ACCELERATOR_PREFIX_ND}-Rsyslog-Role",
13841384
"rsyslog-root-volume-size": 100,
1385-
"rsyslog-max-instance-age": 30
1385+
"rsyslog-max-instance-age": 7
13861386
}
13871387
}
13881388
},
@@ -1467,7 +1467,7 @@
14671467
"access-logs": true,
14681468
"targets": [
14691469
{
1470-
"target-name": "FG1-Web-azA",
1470+
"target-name": "Firewalls",
14711471
"target-type": "instance",
14721472
"protocol": "HTTPS",
14731473
"port": 7001,
@@ -1480,20 +1480,7 @@
14801480
"target": "firewall",
14811481
"name": "Firewall",
14821482
"az": "a"
1483-
}
1484-
],
1485-
"tg-weight": 1
1486-
},
1487-
{
1488-
"target-name": "FG1-Web-azB",
1489-
"target-type": "instance",
1490-
"protocol": "HTTPS",
1491-
"port": 7001,
1492-
"health-check-protocol": "HTTPS",
1493-
"health-check-path": "/health-check",
1494-
"health-check-port": 7001,
1495-
"lambda-filename": "",
1496-
"target-instances": [
1483+
},
14971484
{
14981485
"target": "firewall",
14991486
"name": "Firewall",
@@ -1527,7 +1514,7 @@
15271514
"access-logs": true,
15281515
"targets": [
15291516
{
1530-
"target-name": "FG1-Web-azA",
1517+
"target-name": "Firewalls",
15311518
"target-type": "instance",
15321519
"protocol": "HTTPS",
15331520
"port": 7002,
@@ -1540,20 +1527,7 @@
15401527
"target": "firewall",
15411528
"name": "Firewall",
15421529
"az": "a"
1543-
}
1544-
],
1545-
"tg-weight": 1
1546-
},
1547-
{
1548-
"target-name": "FG1-Web-azB",
1549-
"target-type": "instance",
1550-
"protocol": "HTTPS",
1551-
"port": 7002,
1552-
"health-check-protocol": "HTTPS",
1553-
"health-check-path": "/health-check",
1554-
"health-check-port": 7001,
1555-
"lambda-filename": "",
1556-
"target-instances": [
1530+
},
15571531
{
15581532
"target": "firewall",
15591533
"name": "Firewall",

reference-artifacts/SAMPLE_CONFIGS/BAD-config.test-example.json renamed to reference-artifacts/SAMPLE_CONFIGS/config.test-example.json

Lines changed: 6 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
{
2-
"NOTE": "THIS FILE IS CONTAMINATED WITH ARTIFACTS FROM FUTURE v1.5.0",
32
"replacements": {
43
"addl_regions": {
54
"a": ["${HOME_REGION}"],
@@ -1063,7 +1062,7 @@
10631062
"num-rdgw-hosts": 1,
10641063
"min-rdgw-hosts": 1,
10651064
"max-rdgw-hosts": 2,
1066-
"rdgw-max-instance-age": 30,
1065+
"rdgw-max-instance-age": 7,
10671066
"rdgw-instance-type": "t2.medium",
10681067
"rdgw-instance-role": "${ACCELERATOR_PREFIX_ND}-RDGW-Role",
10691068
"password-policies": {
@@ -1169,7 +1168,7 @@
11691168
"rsyslog-instance-type": "t2.medium",
11701169
"rsyslog-instance-role": "${ACCELERATOR_PREFIX_ND}-Rsyslog-Role",
11711170
"rsyslog-root-volume-size": 100,
1172-
"rsyslog-max-instance-age": 30
1171+
"rsyslog-max-instance-age": 7
11731172
}
11741173
}
11751174
},
@@ -1254,7 +1253,7 @@
12541253
"access-logs": true,
12551254
"targets": [
12561255
{
1257-
"target-name": "FG1-Web-azA",
1256+
"target-name": "Firewalls",
12581257
"target-type": "instance",
12591258
"protocol": "HTTPS",
12601259
"port": 7001,
@@ -1267,20 +1266,7 @@
12671266
"target": "firewall",
12681267
"name": "Firewall",
12691268
"az": "a"
1270-
}
1271-
],
1272-
"tg-weight": 1
1273-
},
1274-
{
1275-
"target-name": "FG1-Web-azB",
1276-
"target-type": "instance",
1277-
"protocol": "HTTPS",
1278-
"port": 7001,
1279-
"health-check-protocol": "HTTPS",
1280-
"health-check-path": "/health-check",
1281-
"health-check-port": 7001,
1282-
"lambda-filename": "",
1283-
"target-instances": [
1269+
},
12841270
{
12851271
"target": "firewall",
12861272
"name": "Firewall",
@@ -1314,7 +1300,7 @@
13141300
"access-logs": true,
13151301
"targets": [
13161302
{
1317-
"target-name": "FG1-Web-azA",
1303+
"target-name": "Firewalls",
13181304
"target-type": "instance",
13191305
"protocol": "HTTPS",
13201306
"port": 7002,
@@ -1327,20 +1313,7 @@
13271313
"target": "firewall",
13281314
"name": "Firewall",
13291315
"az": "a"
1330-
}
1331-
],
1332-
"tg-weight": 1
1333-
},
1334-
{
1335-
"target-name": "FG1-Web-azB",
1336-
"target-type": "instance",
1337-
"protocol": "HTTPS",
1338-
"port": 7002,
1339-
"health-check-protocol": "HTTPS",
1340-
"health-check-path": "/health-check",
1341-
"health-check-port": 7001,
1342-
"lambda-filename": "",
1343-
"target-instances": [
1316+
},
13441317
{
13451318
"target": "firewall",
13461319
"name": "Firewall",

‎reference-artifacts/SCPs/ASEA-Guardrails-Sandbox.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,39 @@
11
{
22
"Version": "2012-10-17",
33
"Statement": [
4+
{
5+
"Sid": "DenySBTag",
6+
"Effect": "Deny",
7+
"Action": [
8+
"ec2:DeleteNatGateway",
9+
"ec2:DeleteTransitGatewayRoute",
10+
"ec2:DeleteTransitGatewayRouteTable",
11+
"ec2:DeleteTransitGatewayVpcAttachment",
12+
"ec2:DeleteVpc",
13+
"ec2:DeleteVpcEndpoints",
14+
"ec2:DeleteVpcPeeringConnection",
15+
"ec2:DeleteCustomerGateway",
16+
"ec2:DeleteDhcpOptions",
17+
"ec2:DeleteInternetGateway",
18+
"ec2:DeleteRouteTable",
19+
"ec2:DeleteSubnet",
20+
"ec2:DeleteRoute",
21+
"ec2:DetachInternetGateway",
22+
"ec2:DisassociateRouteTable"
23+
],
24+
"Resource": "*",
25+
"Condition": {
26+
"StringEquals": {
27+
"ec2:ResourceTag/Accelerator": "${ACCELERATOR_NAME}"
28+
},
29+
"ArnNotLike": {
30+
"aws:PrincipalArn": [
31+
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*",
32+
"arn:aws:iam::*:role/${ACCELERATOR_NAME}Ops-*"
33+
]
34+
}
35+
}
36+
},
437
{
538
"Sid": "DenyAllOutsideCanadaUS",
639
"Effect": "Deny",

0 commit comments

Comments
 (0)