fix(infra): keep the file share off the public internet (PLAT-77)

The instance has no public IP. Office routes use the syslog VPN gateway and other egress uses a NAT gateway. DLM targets the tagged data volume, and replacement detaches stop the instance first.
This commit is contained in:
Adam Moussa 2026-09-28 16:51:29 -04:00
parent dadcf1c5ce
commit cf5efb06ec
No known key found for this signature in database
6 changed files with 75 additions and 10 deletions

View file

@ -89,7 +89,9 @@ Prod changes go through HCP Terraform workspace `file-share-prod` (manual apply
The management-account CDK workflow no longer runs on push. `workflow_dispatch` remains for an explicit rollback of that stack.
Clients use the private IP. Office routing must include `10.40.20.0/24` on the existing syslog IPsec before SMB from the office will work. A check from `10.10.70.0/24` on 2026-09-28 reached the gateway for `10.40.10.254` and got no hop-1 reply for `10.40.20.1`.
The instance has no public IP. Its route table sends `10.10.0.0/16` and `10.30.0.0/16` through the syslog VPN gateway and everything else through a NAT gateway in the syslog public subnet. `10.10.0.0/16` is the Ronkonkoma office LAN and `10.30.0.0/16` is the Locust office LAN, the same pair the syslog VPN already routes. `10.20.0.0/16` is the management VPC and is not routed here.
Clients use the private IP. Office routing must include `10.40.20.0/24` on the existing syslog IPsec before SMB from the office will work. A check from `10.10.70.0/24` on 2026-09-28 reached the gateway for `10.40.10.254` and got no hop-1 reply for `10.40.20.1`. The nightly DLM policy targets volumes tagged `file-share-backup=true`. Tag the copied volume with that key at cutover.
## Expanding Storage

View file

@ -4,7 +4,7 @@ resource "aws_dlm_lifecycle_policy" "nightly" {
state = "ENABLED"
policy_details {
resource_types = ["INSTANCE"]
resource_types = ["VOLUME"]
target_tags = {
"file-share-backup" = "true"

View file

@ -6,7 +6,7 @@ resource "aws_instance" "this" {
subnet_id = aws_subnet.file_share.id
vpc_security_group_ids = [aws_security_group.file_share.id]
iam_instance_profile = aws_iam_instance_profile.this.name
associate_public_ip_address = true
associate_public_ip_address = false
user_data = local.user_data
user_data_replace_on_change = false
@ -25,12 +25,20 @@ resource "aws_instance" "this" {
Name = "file-share"
"file-share-backup" = "true"
}
lifecycle {
postcondition {
condition = self.public_ip == null || self.public_ip == ""
error_message = "file-share must not have a public IP."
}
}
}
resource "aws_volume_attachment" "data" {
count = local.create_instance ? 1 : 0
device_name = "/dev/xvdf"
volume_id = var.data_volume_id
instance_id = aws_instance.this[0].id
device_name = "/dev/xvdf"
volume_id = var.data_volume_id
instance_id = aws_instance.this[0].id
stop_instance_before_detaching = true
}

View file

@ -295,16 +295,27 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
sid = "Ec2Network"
effect = "Allow"
actions = [
"ec2:AllocateAddress",
"ec2:AssociateAddress",
"ec2:AssociateRouteTable",
"ec2:CreateNatGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateTags",
"ec2:DeleteNatGateway",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAddressesAttribute",
"ec2:DescribeNatGateways",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
@ -326,7 +337,9 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcs",
"ec2:DescribeVpnGateways",
"ec2:DisassociateAddress",
"ec2:DisassociateRouteTable",
"ec2:ReleaseAddress",
"ec2:ModifySecurityGroupRules",
"ec2:ModifySubnetAttribute",
"ec2:RevokeSecurityGroupEgress",
@ -415,6 +428,8 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
effect = "Allow"
actions = [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAddressesAttribute",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeImages",
@ -424,6 +439,7 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePrefixLists",
"ec2:DescribeRouteTables",

View file

@ -21,7 +21,7 @@ data "aws_vpn_gateway" "syslog" {
attached_vpc_id = data.aws_vpc.syslog.id
}
data "aws_route_table" "syslog_public" {
data "aws_subnet" "syslog_public" {
vpc_id = data.aws_vpc.syslog.id
filter {
@ -30,11 +30,50 @@ data "aws_route_table" "syslog_public" {
}
}
resource "aws_eip" "nat" {
domain = "vpc"
tags = {
Name = "file-share-nat"
}
}
resource "aws_nat_gateway" "file_share" {
allocation_id = aws_eip.nat.id
subnet_id = data.aws_subnet.syslog_public.id
tags = {
Name = "file-share"
}
}
resource "aws_route_table" "file_share" {
vpc_id = data.aws_vpc.syslog.id
tags = {
Name = "file-share"
}
}
resource "aws_route" "office" {
for_each = toset(local.office_lan_cidrs)
route_table_id = aws_route_table.file_share.id
destination_cidr_block = each.value
gateway_id = data.aws_vpn_gateway.syslog.id
}
resource "aws_route" "nat" {
route_table_id = aws_route_table.file_share.id
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.file_share.id
}
resource "aws_subnet" "file_share" {
vpc_id = data.aws_vpc.syslog.id
cidr_block = local.subnet_cidr
availability_zone = local.subnet_az
map_public_ip_on_launch = true
map_public_ip_on_launch = false
tags = {
Name = "file-share"
@ -55,5 +94,5 @@ resource "aws_subnet" "file_share" {
resource "aws_route_table_association" "file_share" {
subnet_id = aws_subnet.file_share.id
route_table_id = data.aws_route_table.syslog_public.id
route_table_id = aws_route_table.file_share.id
}

View file

@ -4,7 +4,7 @@ output "private_ip" {
}
output "public_ip" {
description = "Egress address for package install and SSM. Not a client endpoint."
description = "Always empty. Egress uses the NAT gateway. Clients use private_ip."
value = one(aws_instance.this[*].public_ip)
}