Skip to content

Commit ee9f83a

Browse files
dyuriawsdyuriaws
committed
deleted second nat gw
1 parent fb81528 commit ee9f83a

File tree

4 files changed

+271
-22
lines changed

4 files changed

+271
-22
lines changed

‎.DS_Store‎

0 Bytes
Binary file not shown.

‎conf/aws-jam-WAF-BOTs-Scrapers-Workshop-team-iam-policy.json‎

Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "VisualEditor0",
6+
"Effect": "Allow",
7+
"Action": [
8+
"ssm:Describe*",
9+
"ssm:List*",
10+
"ssm:Get*",
11+
"ec2:Get*",
12+
"s3:DeleteObject",
13+
"s3:Get*",
14+
"s3:PutObject",
15+
"s3:PutBucketNotification",
16+
"s3:ListBucket",
17+
"s3:AbortMultipartUpload",
18+
"s3:ListAllMyBuckets",
19+
"elasticloadbalancing:SetWebAcl",
20+
"ec2:SearchTransitGatewayRoutes",
21+
"s3:HeadBucket",
22+
"elasticloadbalancing:Describe*",
23+
"ec2:Describe*",
24+
"glue:CreateDatabase",
25+
"glue:GetDatabase",
26+
"glue:GetDatabases",
27+
"glue:UpdateDatabase",
28+
"glue:CreateTable",
29+
"glue:DeleteTable",
30+
"glue:BatchDeleteTable",
31+
"glue:UpdateTable",
32+
"glue:GetTable",
33+
"glue:GetTables",
34+
"glue:BatchCreatePartition",
35+
"glue:CreatePartition",
36+
"glue:DeletePartition",
37+
"glue:BatchDeletePartition",
38+
"glue:UpdatePartition",
39+
"glue:GetPartition",
40+
"glue:GetPartitions",
41+
"glue:BatchGetPartition",
42+
"glue:DeleteDatabase",
43+
"athena:*",
44+
"ssm:SendCommand"
45+
],
46+
"Resource": "*"
47+
},
48+
{
49+
"Effect": "Allow",
50+
"Action": [
51+
"s3:GetBucketLocation",
52+
"s3:GetObject",
53+
"s3:ListBucket",
54+
"s3:ListBucketMultipartUploads",
55+
"s3:ListMultipartUploadParts",
56+
"s3:AbortMultipartUpload",
57+
"s3:CreateBucket",
58+
"s3:PutObject"
59+
],
60+
"Resource": [
61+
"arn:aws:s3:::aws-athena-query-results-*"
62+
]
63+
},
64+
{
65+
"Effect": "Allow",
66+
"Action": [
67+
"cloudwatch:PutMetricAlarm",
68+
"cloudwatch:DescribeAlarms",
69+
"cloudwatch:DeleteAlarms"
70+
],
71+
"Resource": [
72+
"*"
73+
]
74+
},
75+
{
76+
"Sid": "VisualEditor1",
77+
"Effect": "Deny",
78+
"Action": [
79+
"es:Create*",
80+
"es:Purchase*",
81+
"es:UpgradeElasticsearchDomain",
82+
"es:UpdateElasticsearchDomainConfig",
83+
"es:Delete*"
84+
],
85+
"Resource": "*"
86+
},
87+
{
88+
"Action": [
89+
"logs:Describe*",
90+
"logs:Get*",
91+
"logs:List*",
92+
"logs:StartQuery",
93+
"logs:StopQuery",
94+
"logs:TestMetricFilter",
95+
"logs:FilterLogEvents"
96+
],
97+
"Effect": "Allow",
98+
"Resource": "*"
99+
},
100+
{
101+
"Effect": "Allow",
102+
"Action": [
103+
"apigateway:*"
104+
],
105+
"Resource": "arn:aws:apigateway:*::/*"
106+
},
107+
{
108+
"Effect": "Allow",
109+
"Action": [
110+
"cloudformation:DescribeChangeSet",
111+
"cloudformation:DescribeStackResources",
112+
"cloudformation:DescribeStacks",
113+
"cloudformation:GetTemplate",
114+
"cloudformation:ListStackResources",
115+
"cloudwatch:Describe*",
116+
"cloudwatch:Get*",
117+
"cloudwatch:List*",
118+
"cognito-identity:ListIdentityPools",
119+
"cognito-sync:GetCognitoEvents",
120+
"dynamodb:BatchGetItem",
121+
"dynamodb:DescribeStream",
122+
"dynamodb:DescribeTable",
123+
"dynamodb:GetItem",
124+
"dynamodb:ListStreams",
125+
"dynamodb:ListTables",
126+
"dynamodb:Query",
127+
"dynamodb:Scan",
128+
"ec2:DescribeSecurityGroups",
129+
"ec2:DescribeSubnets",
130+
"ec2:DescribeVpcs",
131+
"events:Describe*",
132+
"events:List*",
133+
"iam:GetPolicy",
134+
"iam:GetPolicyVersion",
135+
"iam:GetRole",
136+
"iam:GetRolePolicy",
137+
"iam:ListAttachedRolePolicies",
138+
"iam:ListRolePolicies",
139+
"iam:ListRoles",
140+
"iot:DescribeEndpoint",
141+
"iot:GetTopicRule",
142+
"iot:ListPolicies",
143+
"iot:ListThings",
144+
"iot:ListTopicRules",
145+
"kinesis:DescribeStream",
146+
"kinesis:ListStreams",
147+
"kms:ListAliases",
148+
"lambda:Get*",
149+
"lambda:List*",
150+
"logs:DescribeLogGroups",
151+
"logs:DescribeLogStreams",
152+
"logs:DescribeMetricFilters",
153+
"logs:GetLogEvents",
154+
"s3:Get*",
155+
"s3:List*",
156+
"sns:ListSubscriptions",
157+
"sns:ListSubscriptionsByTopic",
158+
"sns:ListTopics",
159+
"sqs:ListQueues",
160+
"tag:GetResources",
161+
"ec2:StartInstances",
162+
"ec2:StopInstances"
163+
],
164+
"Resource": "*"
165+
},
166+
{
167+
"Action": [
168+
"es:*"
169+
],
170+
"Effect": "Allow",
171+
"Resource": "*"
172+
},
173+
{
174+
"Action": [
175+
"waf:*",
176+
"waf-regional:*",
177+
"elasticloadbalancing:SetWebACL"
178+
],
179+
"Effect": "Allow",
180+
"Resource": "*"
181+
},
182+
{
183+
"Action": [
184+
"firehose:*"
185+
],
186+
"Effect": "Allow",
187+
"Resource": "*"
188+
},
189+
{
190+
"Action": [
191+
"autoscaling:Describe*",
192+
"cloudwatch:Describe*",
193+
"cloudwatch:Get*",
194+
"cloudwatch:List*",
195+
"logs:Get*",
196+
"logs:List*",
197+
"logs:Describe*",
198+
"logs:TestMetricFilter",
199+
"logs:FilterLogEvents",
200+
"sns:Get*",
201+
"sns:List*"
202+
],
203+
"Effect": "Allow",
204+
"Resource": "*"
205+
},
206+
{
207+
"Effect": "Allow",
208+
"Action": "events:*",
209+
"Resource": "*"
210+
},
211+
{
212+
"Effect": "Allow",
213+
"Action": "iam:PassRole",
214+
"Resource": "arn:aws:iam::*:role/*",
215+
"Condition": {
216+
"StringLike": {
217+
"iam:PassedToService": "events.amazonaws.com"
218+
}
219+
}
220+
},
221+
{
222+
"Effect": "Allow",
223+
"Action": [
224+
"lambda:UpdateFunctionCode",
225+
"lambda:PublishVersion",
226+
"lambda:DeleteEventSourceMapping",
227+
"lambda:UpdateEventSourceMapping",
228+
"lambda:DeleteAlias",
229+
"lambda:InvokeFunction",
230+
"lambda:UpdateAlias",
231+
"lambda:CreateAlias",
232+
"lambda:PublishLayerVersion",
233+
"lambda:CreateEventSourceMapping",
234+
"lambda:PutFunctionConcurrency",
235+
"lambda:DeleteLayerVersion",
236+
"lambda:DeleteFunctionConcurrency"
237+
],
238+
"Resource": "*"
239+
},
240+
{
241+
"Effect": "Deny",
242+
"Action": [
243+
"lambda:UpdateFunctionCode",
244+
"lambda:PublishVersion",
245+
"lambda:DeleteEventSourceMapping",
246+
"lambda:UpdateEventSourceMapping",
247+
"lambda:DeleteAlias",
248+
"lambda:InvokeFunction",
249+
"lambda:UpdateAlias",
250+
"lambda:CreateAlias",
251+
"lambda:PublishLayerVersion",
252+
"lambda:CreateEventSourceMapping",
253+
"lambda:PutFunctionConcurrency",
254+
"lambda:DeleteLayerVersion",
255+
"lambda:DeleteFunctionConcurrency"
256+
],
257+
"Resource": "arn:aws:lambda:*:*:function:jam2-EditSGLambdaFunction*"
258+
},
259+
{
260+
"Effect": "Allow",
261+
"Action": [
262+
"lambda:AddPermission"
263+
],
264+
"Resource": "arn:aws:lambda:*:*:function:*LambdaLogParserFunction*"
265+
}
266+
]
267+
}

‎template/aws-waf-security-automations-template.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -239,11 +239,10 @@ Resources:
239239
EnvironmentName: 'DEV'
240240
KeyName: 'WAF-BOTs-Scrapers'
241241
MyIP: '69.254.0.1/32'
242-
InstanceType: 'c5.large'
242+
InstanceType: 't3.medium'
243243
DesiredCapacity: '1'
244244
MaxSize: '1'
245-
AttackerInstanceType: 't3.xlarge'
246-
DBInstanceType: 'db.m5.4xlarge'
245+
AttackerInstanceType: 't3.large'
247246
DBAdmin: 'WebCarter'
248247
DBPassword: !Ref AdminPassword
249248
RdsAdminUsername: 'master'

‎template/webcarter-attacker-template.yaml‎

Lines changed: 2 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ Metadata:
2525
- DesiredCapacity
2626
- MaxSize
2727
- AttackerInstanceType
28-
- DBInstanceType
2928
-
3029
Label:
3130
default: Credentials
@@ -549,21 +548,11 @@ Resources:
549548
DependsOn: InternetGatewayAttachment
550549
Properties:
551550
Domain: vpc
552-
NatGateway2EIP:
553-
Type: AWS::EC2::EIP
554-
DependsOn: InternetGatewayAttachment
555-
Properties:
556-
Domain: vpc
557551
NatGateway1:
558552
Type: AWS::EC2::NatGateway
559553
Properties:
560554
AllocationId: !GetAtt NatGateway1EIP.AllocationId
561555
SubnetId: !Ref PublicSubnet1
562-
NatGateway2:
563-
Type: AWS::EC2::NatGateway
564-
Properties:
565-
AllocationId: !GetAtt NatGateway2EIP.AllocationId
566-
SubnetId: !Ref PublicSubnet2
567556

568557
PublicRouteTable:
569558
Type: AWS::EC2::RouteTable
@@ -691,12 +680,6 @@ Resources:
691680
Tags:
692681
- Key: Name
693682
Value: !Sub ${EnvironmentName} Private Routes (AZ2)
694-
DefaultPrivateRoute2:
695-
Type: AWS::EC2::Route
696-
Properties:
697-
RouteTableId: !Ref PrivateRouteTable2
698-
DestinationCidrBlock: 0.0.0.0/0
699-
NatGatewayId: !Ref NatGateway2
700683
PrivateSubnet2RouteTableAssociation:
701684
Type: AWS::EC2::SubnetRouteTableAssociation
702685
Properties:
@@ -870,9 +853,9 @@ Resources:
870853
Priority: 1
871854
webCarterAutoScalingGroup:
872855
Type: AWS::AutoScaling::AutoScalingGroup
873-
DependsOn: [PrivateSubnet1RouteTableAssociation, PrivateSubnet2RouteTableAssociation, InitInstance]
856+
DependsOn: [PrivateSubnet1RouteTableAssociation, InitInstance]
874857
Properties:
875-
VPCZoneIdentifier: [!Ref 'PrivateSubnet1', !Ref 'PrivateSubnet2']
858+
VPCZoneIdentifier: [!Ref 'PrivateSubnet1']
876859
HealthCheckGracePeriod: 300
877860
LaunchConfigurationName: !Ref 'ContainerInstances'
878861
MinSize: '1'

0 commit comments

Comments
 (0)