This application will deploy a Lambda function connected to an HTTP API. When a request is made to the exported endpoint the source IP will allowed on Security Group with specified port and protocol.
This application will create two Lambda function for manage allow IP and flush rules process. Allow IP Lambda function has permissions to call AuthorizeSecurityGroupIngress EC2 API. Flush rules Lambda function has permissions to describe security group and call RevokeSecurityGroupIngress EC2 API. An API Gateway endpoint is created and connected to the allow IP Lambda function. A scheduled CloudWatch Event is created to trigger flush rules Lambda function at regular intervals.
Region | Deploy Link |
---|---|
eu-west-1 | ![]() |
eu-central-1 | ![]() |
us-east-1 | ![]() |
us-east-2 | ![]() |
Using the SAM CLI:
sam build
sam deploy --guided
Including in an other SAM template:
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
DynamicIpWhitelist:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: # pick a templates links from section below, based on your region
Parameters:
Token: xxxxxxxxxxxxxxxxxxxxxxxxx
SecurityGroupId: sg-xxxxxxxxxxxx
This application need some required parameters when you deploy it:
-
StageName: The name that identify the API stage.
-
Token: The token used to validate the request, requires at least 20 characters in length.
-
SecurityGroupId: The Security Group where add rules to.
Optional parameters:
-
IngressPort: Ingress port to allow. Can be also a range, for example "7000-8000".
-
IngressProtocol: Ingress protocol to allow. Can be TCP, UDP or ICMP.
-
RuleDescription: The rules descriptions used to identify rules.
-
FlushScheduleExpression: The CloudWatch Event scheduled expression to trigger flush rules process.
-
TokenParameterId: The SSM Parameter where Token value is stored.
-
Endpoint: The endpoint to send request to whitelist IP, for example
https://xxxxxx.execute-api.eu-west-1.amazonaws.com/test/<place here the provided token>/
.
- Repository badges by Shields.io
- Infrastructure schema by Cloudcraft