Rethink network security group permissions

[davecash75]

Short Description

The policies of the current security groups in the xnat-aws is likely too restrictive. We need to think about what makes sense for usability within UCL for courses and for public.

Evidence/Steps to Reproduce

Currently, terraform only allows access to xnat-web and xnat-cserv to the IP that made the call to terraform. The issue becomes if someone disconnects their laptop and gets a new IP from UCL, then you have to re-adjust the security group rules to allow access to the new IP address.
Also, we want the Appstream to have access to the web server and the EFS as well, especially if we create the infrastructure and want the attendees to interact with the server via AppStream.
I confirmed this as I was unable to work with the web server or SSH into the server after leaving the office, and then when I changed the security group to allow my new IP address and the private subnets in the network, then I was able to work with these components again.

Acceptance Criteria/Expected Behaviour

When the problem is resolved, the people setting up the infrastructure can keep working on it from another IP address, and attendees can access web browser through ApStream

Details

No response

Resolution

No response

[p-j-smith]

Currently, terraform only allows access to xnat-web and xnat-cserv to the IP that made the call to terraform. The issue becomes if someone disconnects their laptop and gets a new IP from UCL, then you have to re-adjust the security group rules to allow access to the new IP address.

To allow access to additional IP address, you can set the extend_ssh_cidr and extend_http_cidr variables. So to allow access from anywhere you would add this to your provision/terrraform.tfvars file:

extend_http_cidr = [
  "0.0.0.0/0",
]
extend_ssh_cidr = [
  "0.0.0.0/0",
]

Or to allow access only from within UCL you could use the list of IPv4 ranges here.

Also, we want the Appstream to have access to the web server and the EFS as well, especially if we create the infrastructure and want the attendees to interact with the server via AppStream.

Yep good point, we definitely need to do that

[davecash75]

To allow access to additional IP address, you can set the extend_ssh_cidr and extend_http_cidr variables. So to allow access from anywhere you would add this to your provision/terrraform.tfvars file:

Ahh, apologies, I missed that reference in the README. Ok, will add that when I spin things up again.

[p-j-smith]

no worries, it's really hidden away. We should probably link to that section in the top-level README