Skip to content

Commit 31e14fd

Browse files
rangfelirangfeli
committed
fix: storage recipe security group lookup custom resource fixes and making ClientIpCidr optional
1 parent ee6a3a3 commit 31e14fd

File tree

3 files changed

+39
-39
lines changed

3 files changed

+39
-39
lines changed

‎recipes/storage/efs_simple/assets/main.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,15 +135,13 @@ Resources:
135135

136136
EfsSecurityGroupInboundRule:
137137
Type: 'AWS::EC2::SecurityGroupIngress'
138+
Condition: CreateSecurityGroup
138139
Properties:
139140
IpProtocol: tcp
140141
Description: Allow incoming traffic to EFS from members of security group
141142
FromPort: 2049
142143
ToPort: 2049
143-
GroupId: !If
144-
- CreateSecurityGroup
145-
- !Ref EfsSecurityGroup
146-
- !GetAtt SecurityGroupLookup.GroupId
144+
GroupId: !Ref EfsSecurityGroup
147145
SourceSecurityGroupId: !Ref EfsClientSecurityGroup
148146

149147
EfsClientSecurityGroupOutboundRule:
@@ -197,6 +195,7 @@ Resources:
197195
Condition: UseExistingSecurityGroup
198196
Properties:
199197
ServiceToken: !GetAtt SecurityGroupLookupFunction.Arn
198+
ServiceTimeout: 60
200199
VpcId: !Ref VpcId
201200
GroupName: !Ref SecurityGroupName
202201

@@ -226,6 +225,7 @@ Resources:
226225
Type: AWS::Lambda::Function
227226
Condition: UseExistingSecurityGroup
228227
Properties:
228+
Timeout: 60
229229
Runtime: python3.9
230230
Handler: index.handler
231231
Role: !GetAtt SecurityGroupLookupRole.Arn

‎recipes/storage/fsx_lustre/assets/scratch.yaml‎

Lines changed: 17 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -55,12 +55,12 @@ Conditions:
5555
Resources:
5656

5757
LustreServersSG:
58-
Type: AWS::EC2::SecurityGroup
59-
Condition: CreateSecurityGroup
60-
Properties:
61-
GroupDescription: 'Allows traffic to FSx for Lustre filesystem'
62-
GroupName: !Sub '${AWS::StackName}-fsxl-security-group'
63-
VpcId: !Ref VpcId
58+
Type: AWS::EC2::SecurityGroup
59+
Condition: CreateSecurityGroup
60+
Properties:
61+
GroupDescription: 'Allows traffic to FSx for Lustre filesystem'
62+
GroupName: !Sub '${AWS::StackName}-fsxl-security-group'
63+
VpcId: !Ref VpcId
6464

6565
LustreClientsSG:
6666
Type: AWS::EC2::SecurityGroup
@@ -81,16 +81,14 @@ Resources:
8181

8282
LustreClientsSGxxFROMxxLustreServersSG988:
8383
Type: AWS::EC2::SecurityGroupIngress
84+
Condition: CreateSecurityGroup
8485
Properties:
8586
IpProtocol: tcp
8687
Description: Allows Lustre traffic on port 988 between Amazon FSx for Lustre file servers and Lustre clients
8788
FromPort: 988
8889
ToPort: 988
8990
GroupId: !Ref LustreClientsSG
90-
SourceSecurityGroupId: !If
91-
- CreateSecurityGroup
92-
- !Ref LustreServersSG
93-
- !GetAtt SecurityGroupLookup.GroupId
91+
SourceSecurityGroupId: !Ref LustreServersSG
9492

9593
LustreClientsSGfromLustreClients1021:
9694
Type: AWS::EC2::SecurityGroupIngress
@@ -104,16 +102,14 @@ Resources:
104102

105103
LustreClientsSGxxFROMxxLustreServersSG1021:
106104
Type: AWS::EC2::SecurityGroupIngress
105+
Condition: CreateSecurityGroup
107106
Properties:
108107
IpProtocol: tcp
109108
Description: Allows Lustre traffic on ports 1021-23 between Amazon FSx for Lustre file servers and Lustre clients
110109
FromPort: 1021
111110
ToPort: 1023
112111
GroupId: !Ref LustreClientsSG
113-
SourceSecurityGroupId: !If
114-
- CreateSecurityGroup
115-
- !Ref LustreServersSG
116-
- !GetAtt SecurityGroupLookup.GroupId
112+
SourceSecurityGroupId: !Ref LustreServersSG
117113

118114
LustreClientsSGtoLustreClients988:
119115
Type: AWS::EC2::SecurityGroupEgress
@@ -127,19 +123,18 @@ Resources:
127123

128124
LustreClientsSGtopclusterLustreServersSG:
129125
Type: AWS::EC2::SecurityGroupEgress
126+
Condition: CreateSecurityGroup
130127
Properties:
131128
IpProtocol: tcp
132129
Description: Allow Lustre traffic on port 988 between Amazon FSx for Lustre file servers and Lustre clients
133130
FromPort: 988
134131
ToPort: 988
135132
GroupId: !Ref LustreClientsSG
136-
DestinationSecurityGroupId: !If
137-
- CreateSecurityGroup
138-
- !Ref LustreServersSG
139-
- !GetAtt SecurityGroupLookup.GroupId
133+
DestinationSecurityGroupId: !Ref LustreServersSG
140134

141135
LustreClientsSGtoLustreClients1021:
142136
Type: AWS::EC2::SecurityGroupEgress
137+
Condition: CreateSecurityGroup
143138
Properties:
144139
IpProtocol: tcp
145140
Description: Allows Lustre traffic on ports 1021-23 between Amazon FSx for Lustre clients
@@ -150,16 +145,14 @@ Resources:
150145

151146
LustreClientsSGtoLustreServersSG:
152147
Type: AWS::EC2::SecurityGroupEgress
148+
Condition: CreateSecurityGroup
153149
Properties:
154150
IpProtocol: tcp
155151
Description: Allows Lustre traffic on ports 1021-23 between Amazon FSx for Lustre file servers and Lustre clients
156152
FromPort: 1021
157153
ToPort: 1023
158154
GroupId: !Ref LustreClientsSG
159-
DestinationSecurityGroupId: !If
160-
- CreateSecurityGroup
161-
- !Ref LustreServersSG
162-
- !GetAtt SecurityGroupLookup.GroupId
155+
DestinationSecurityGroupId: !Ref LustreServersSG
163156

164157
FSxLFilesystem:
165158
Type: AWS::FSx::FileSystem
@@ -190,6 +183,7 @@ Resources:
190183
Condition: UseExistingSecurityGroup
191184
Properties:
192185
ServiceToken: !GetAtt SecurityGroupLookupFunction.Arn
186+
ServiceTimeout: 60
193187
VpcId: !Ref VpcId
194188
GroupName: !Ref SecurityGroupName
195189

@@ -219,6 +213,7 @@ Resources:
219213
Type: AWS::Lambda::Function
220214
Condition: UseExistingSecurityGroup
221215
Properties:
216+
Timeout: 60
222217
Runtime: python3.9
223218
Handler: index.handler
224219
Role: !GetAtt SecurityGroupLookupRole.Arn

‎recipes/storage/fsx_ontap/assets/main.yaml‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ Metadata:
99
Parameters:
1010
- VpcId
1111
- SubnetId
12-
- ClientIpCidr
1312
- SecurityGroupName
13+
- ClientIpCidr
1414
- KmsKeyId
1515
- Label:
1616
default: File System Options
@@ -42,16 +42,16 @@ Parameters:
4242
SubnetId:
4343
Type: AWS::EC2::Subnet::Id
4444
Description: Subnet ID where the file system will be created (must be in same VPC).
45-
ClientIpCidr:
46-
Description: CIDR block controlling incoming NFS and/or SMB traffic to FSx file system.
47-
Default: ""
48-
Type: String
49-
AllowedPattern: ^((\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}))?$
50-
ConstraintDescription: ClientIP must be a valid IP or network range of the form x.x.x.x/x. specify your IP/NETMASK (e.g x.x.x/32 or x.x.x.x/24 for subnet range)
5145
SecurityGroupName:
5246
Type: String
5347
Description: (Optional) An existing security group to associate to the file system (must be in same VPC). If none is provided, a new security group will be created.
5448
Default: ""
49+
ClientIpCidr:
50+
Type: String
51+
Description: (Optional) If no existing security group is provided, then provide a CIDR block controlling incoming NFS and/or SMB traffic to FSx file system.
52+
Default: ""
53+
AllowedPattern: ^$|^((\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}))?$
54+
ConstraintDescription: ClientIP must be a valid IP or network range of the form x.x.x.x/x. specify your IP/NETMASK (e.g x.x.x/32 or x.x.x.x/24 for subnet range)
5555
KmsKeyId:
5656
Type: String
5757
Description: (Optional) An existing ID of the AWS Key Management Service (AWS KMS) key used to encrypt Amazon FSx file system data. If none is provided, the default aws/fsx encryption key will be used.
@@ -78,9 +78,9 @@ Parameters:
7878
OntapHAPairs:
7979
Type: Number
8080
Description: Number of high-availability (HA) pairs of file servers will power your file system. Default is set to 1 HA pair.
81-
ConstraintDescription: "Minimum: 1 HA pair"
8281
Default: 1
8382
MinValue: 1
83+
ConstraintDescription: "Minimum: 1 HA pair"
8484
OntapDiskIopsMode:
8585
Type: String
8686
Description: Specifies whether the file system is using the AUTOMATIC setting of SSD IOPS of 3 IOPS per GB of storage capacity, or if it is using a USER_PROVISIONED value. Default is set to AUTOMATIC.
@@ -91,15 +91,15 @@ Parameters:
9191
OntapDiskIops:
9292
Type: Number
9393
Description: Total number of SSD IOPS provisioned for the file system if using USER_PROVISIONED for file system's disk IOPS. Default is set to 3,072 SSD IOPS.
94-
ConstraintDescription: "Minimum: 3,072 SSD IOPS"
9594
Default: 3072
9695
MinValue: 3072
96+
ConstraintDescription: "Minimum: 3,072 SSD IOPS"
9797
OntapThroughputCapacity:
9898
Type: Number
9999
Description: Throughput capacity for the file system (MBps). Default is set to 384 MBps.
100-
ConstraintDescription: "Minimum: 384 MBps"
101100
Default: 384
102101
MinValue: 384
102+
ConstraintDescription: "Minimum: 384 MBps"
103103
OntapSecurityStyle:
104104
Type: String
105105
Description: Security style of the file system's volumes. Default is set to UNIX.
@@ -111,9 +111,9 @@ Parameters:
111111
OntapVolumeJunctionPath:
112112
Type: String
113113
Description: The location in the storage virtual machine's namespace where the non-root volume is mounted. Default is set to /vol1.
114-
ConstraintDescription: "Must start with /"
115114
Default: "/vol1"
116115
AllowedPattern: "^/[a-zA-Z0-9-_/]+$"
116+
ConstraintDescription: "Must start with /"
117117
EnableActiveDirectory:
118118
Type: String
119119
Description: Enable file system to join an Active Directory. Required for Windows SMB clients to mount file system. Default is set to false.
@@ -132,9 +132,9 @@ Parameters:
132132
ServiceAccountCredentialsSecretArn:
133133
Type: String
134134
Description: Directory Service Root (Service Account) Credentials Secret ARN. The username and password for the Active Directory ServiceAccount user formatted as a username:password key/value pair.
135-
ConstraintDescription: "Secret name can be 512 characters long and may include letters, numbers, and the following characters: /_+=.@-."
136-
AllowedPattern: ^$|^(?:arn:(?:aws|aws-us-gov|aws-cn):secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[A-Za-z0-9\-\_\+\=\/\.\@]{1,519})?$
137135
Default: ""
136+
AllowedPattern: ^$|^(?:arn:(?:aws|aws-us-gov|aws-cn):secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[A-Za-z0-9\-\_\+\=\/\.\@]{1,519})?$
137+
ConstraintDescription: "Secret name can be 512 characters long and may include letters, numbers, and the following characters: /_+=.@-."
138138
ComputersOU:
139139
Type: String
140140
Description: Organization Unit (OU) for compute and storage servers in the Active Directory.
@@ -164,6 +164,11 @@ Conditions:
164164
- !Condition CreateCIFSShare
165165

166166
Rules:
167+
RequireSecurityGroupRule:
168+
RuleCondition: !Equals [!Ref SecurityGroupName, ""]
169+
Assertions:
170+
- Assert: !Not [!Equals [!Ref ClientIpCidr, ""]]
171+
AssertDescription: If a SecurityGroupName is not provided, a valid ClientIpCidr must be provided.
167172
ActiveDirectoryParametersRule:
168173
RuleCondition: !Equals [!Ref EnableActiveDirectory, "true"]
169174
Assertions:

0 commit comments

Comments
 (0)