Harden YOLO: fix RDS ingress, remove dead EC2 SG, lock down S3 buckets

src/Commands/SyncComputeCommand.php

@@ -10,6 +10,7 @@ class SyncComputeCommand extends SyncSteppedCommand
         Steps\Fargate\SyncEcrRepositoryStep::class,
         Steps\Fargate\SyncEcsClusterStep::class,
         Steps\Fargate\SyncTaskSecurityGroupStep::class,
+        Steps\Network\SyncRdsSecurityGroupStep::class,
         Steps\Fargate\SyncLoadBalancerStep::class,
         Steps\Fargate\SyncTargetGroupStep::class,
         Steps\Fargate\SyncHttpListenerStep::class,

src/Commands/SyncNetworkCommand.php

@@ -27,8 +27,6 @@ class SyncNetworkCommand extends SyncSteppedCommand
 
         // security groups
         Steps\Network\SyncLoadBalancerSecurityGroupStep::class,
-        Steps\Network\SyncEc2SecurityGroupStep::class,
-        Steps\Network\SyncRdsSecurityGroupStep::class,
 
         // sns
         Steps\Network\SyncSnsAlarmTopicStep::class,

src/Concerns/UsesEc2.php

@@ -6,7 +6,6 @@
 use Codinglabs\Yolo\Aws;
 use Codinglabs\Yolo\Helpers;
 use Codinglabs\Yolo\Manifest;
-use Codinglabs\Yolo\Enums\Iam;
 use Codinglabs\Yolo\AwsResources;
 use Codinglabs\Yolo\Enums\PublicSubnets;
 use Codinglabs\Yolo\Enums\SecurityGroup;
@@ -18,22 +17,16 @@ trait UsesEc2
 
     protected static array $internetGateway;
 
-    protected static array $launchTemplate;
-
     protected static array $subnets;
 
     protected static array $routeTable;
 
     protected static array $loadBalancerSecurityGroup;
 
-    protected static array $ec2SecurityGroup;
-
     protected static array $ecsTaskSecurityGroup;
 
     protected static array $rdsSecurityGroup;
 
-    protected static array $keyPair;
-
     public static function availabilityZones(string $region): array
     {
         $availabilityZones = Aws::ec2()->describeAvailabilityZones([
@@ -117,20 +110,6 @@ public static function loadBalancerSecurityGroup(): array
         return static::$loadBalancerSecurityGroup;
     }
 
-    /**
-     * @throws ResourceDoesNotExistException
-     */
-    public static function ec2SecurityGroup(): array
-    {
-        if (isset(static::$ec2SecurityGroup)) {
-            return static::$ec2SecurityGroup;
-        }
-
-        static::$ec2SecurityGroup = static::securityGroupByName(Manifest::get('aws.ec2.security-group', SecurityGroup::EC2_SECURITY_GROUP));
-
-        return static::$ec2SecurityGroup;
-    }
-
     /**
      * @throws ResourceDoesNotExistException
      */
@@ -179,59 +158,6 @@ public static function securityGroupByName(string|BackedEnum $name): array
         throw new ResourceDoesNotExistException("Could not find Security Group matching name $name");
     }
 
-    public static function launchTemplate($refresh = false): array
-    {
-        if (! $refresh && isset(static::$launchTemplate)) {
-            return static::$launchTemplate;
-        }
-
-        $launchTemplates = Aws::ec2()->describeLaunchTemplates([
-            'Filters' => [
-                [
-                    'Name' => 'launch-template-name',
-                    'Values' => [Helpers::keyedResourceName(exclusive: false)],
-                ],
-            ],
-        ])['LaunchTemplates'];
-
-        if (count($launchTemplates) === 0) {
-            throw ResourceDoesNotExistException::make(sprintf('Could not find launch template %s', Helpers::keyedResourceName()))
-                ->suggest('compute:sync');
-        }
-
-        static::$launchTemplate = $launchTemplates[0];
-
-        return static::$launchTemplate;
-    }
-
-    public static function launchTemplatePayload(): array
-    {
-        return [
-            'LaunchTemplateName' => Helpers::keyedResourceName(exclusive: false),
-            'LaunchTemplateData' => [
-                'IamInstanceProfile' => [
-                    'Name' => Helpers::keyedResourceName(Iam::INSTANCE_PROFILE, exclusive: false),
-                ],
-                'InstanceType' => Manifest::get('aws.ec2.instance-type'),
-                'KeyName' => Manifest::get('aws.ec2.key-pair', Helpers::keyedResourceName(exclusive: false)),
-                'SecurityGroupIds' => [
-                    AwsResources::ec2SecurityGroup()['GroupId'],
-                ],
-                'Monitoring' => [
-                    'Enabled' => true,
-                ],
-            ],
-            'TagSpecifications' => [
-                [
-                    'ResourceType' => 'launch-template',
-                    ...Aws::tags([
-                        'Name' => Helpers::keyedResourceName(),
-                    ]),
-                ],
-            ],
-        ];
-    }
-
     public static function vpc(): array
     {
         if (isset(static::$vpc)) {
@@ -357,24 +283,4 @@ public static function subnetByName(string $name, $relative = true): array
 
         throw new ResourceDoesNotExistException("Could not find subnet matching name $fullSubnetName");
     }
-
-    public static function keyPair(): array
-    {
-        if (isset(static::$keyPair)) {
-            return static::$keyPair;
-        }
-
-        $name = Manifest::get('aws.ec2.key-pair', Helpers::keyedResourceName(exclusive: false));
-
-        foreach (Aws::ec2()->describeKeyPairs()['KeyPairs'] as $keyPair) {
-            if ($keyPair['KeyName'] === $name) {
-                static::$keyPair = $keyPair;
-
-                return $keyPair;
-            }
-        }
-
-        throw ResourceDoesNotExistException::make("Could not find key pair with name $name")
-            ->suggest('sync:network');
-    }
 }

src/Enums/SecurityGroup.php

@@ -4,7 +4,6 @@
 
 enum SecurityGroup: string
 {
-    case EC2_SECURITY_GROUP = 'ec2-security-group';
     case ECS_TASK_SECURITY_GROUP = 'ecs-task-security-group';
     case LOAD_BALANCER_SECURITY_GROUP = 'load-balancer-security-group';
     case RDS_SECURITY_GROUP = 'rds-security-group';

src/Enums/SecurityGroupRule.php

@@ -6,7 +6,5 @@ enum SecurityGroupRule: string
 {
     case LOAD_BALANCER_HTTP_RULE = 'load-balancer-http';
     case LOAD_BALANCER_HTTPS_RULE = 'load-balancer-https';
-    case LOAD_BALANCER_INGRESS_RULE = 'load-balancer-ingress';
     case ECS_TASK_LB_INGRESS_RULE = 'ecs-task-lb-ingress';
-    case SSH_INGRESS_RULE = 'ssh-ingress';
 }