Class: Putpaws::Provision::Resources::SecurityGroup

Inherits:
Base
  • Object
show all
Defined in:
lib/putpaws/provision/resources/security_group.rb

Overview

When base.security_group_ids is set, the existing security groups are used as-is (putpaws never touches their rules). Otherwise a new one is created with no ingress rules (egress open by default). Ingress for ALB etc. is out of scope: add manually or by another command.

Instance Attribute Summary

Attributes inherited from Base

#clients, #config, #state

Instance Method Summary collapse

Methods inherited from Base

#changed?, #ensure!, #initialize, #kind, #plan, #update!

Constructor Details

This class inherits a constructor from Putpaws::Provision::Resources::Base

Instance Method Details

#create! ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/putpaws/provision/resources/security_group.rb', line 53

def create!
  res = clients.ec2.create_security_group(
    group_name: name,
    description: "Managed by putpaws for #{config.service_name}",
    vpc_id: config.base[:vpc_id],
    tag_specifications: [
      {resource_type: 'security-group', tags: [MANAGED_TAG]}
    ]
  )
  {security_group_ids: [res.group_id]}
end

#current ⇒ Object 



27
28
29
30
31
32
33
34
 
# File 'lib/putpaws/provision/resources/security_group.rb', line 27

def current
  return current_specified if specified?
  res = clients.ec2.describe_security_groups(filters: [
    {name: 'group-name', values: [name]},
    {name: 'vpc-id', values: [config.base[:vpc_id]]},
  ])
  res.security_groups.first
end

#current_specified ⇒ Object 



36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/putpaws/provision/resources/security_group.rb', line 36

def current_specified
  res = begin
    clients.ec2.describe_security_groups(group_ids: specified_ids)
  rescue Aws::EC2::Errors::InvalidGroupNotFound
    raise "Specified security group not found: #{specified_ids.join(', ')}"
  end
  found = res.security_groups
  missing = specified_ids - found.map(&:group_id)
  raise "Specified security group not found: #{missing.join(', ')}" if missing.any?
  wrong = found.reject{|sg| sg.vpc_id == config.base[:vpc_id]}
  if wrong.any?
    sg = wrong.first
    raise "Security group #{sg.group_id} belongs to #{sg.vpc_id}, not #{config.base[:vpc_id]}"
  end
  found
end

#name ⇒ Object 



23
24
25
 
# File 'lib/putpaws/provision/resources/security_group.rb', line 23

def name
  specified? ? "#{specified_ids.join(', ')} (existing)" : config.sg_name
end

#outputs(current) ⇒ Object 



65
66
67
68
 
# File 'lib/putpaws/provision/resources/security_group.rb', line 65

def outputs(current)
  ids = current.is_a?(Array) ? current.map(&:group_id) : [current.group_id]
  {security_group_ids: ids}
end

#specified? ⇒ Boolean

Returns:

  • (Boolean) 


19
20
21
 
# File 'lib/putpaws/provision/resources/security_group.rb', line 19

def specified?
  specified_ids.any?
end

#specified_ids ⇒ Object 



12
13
14
15
16
17
 
# File 'lib/putpaws/provision/resources/security_group.rb', line 12

def specified_ids
  ids = Array(config.base[:security_group_ids])
  # backward compatible with the singular key
  ids = [config.base[:security_group_id]] if ids.empty?
  ids.reject{|x| Util.blank?(x)}
end