Skip to content

Commit cb16386

Browse files
farskifarski
committed
Remove VPC Endpoint security group usage
1 parent 269fd80 commit cb16386

File tree

12 files changed

+0
-111
lines changed

12 files changed

+0
-111
lines changed

‎spire/templates/apps-100A.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,6 @@ Parameters:
2424
VpcPrivateSubnet1Id: { Type: AWS::EC2::Subnet::Id }
2525
VpcPrivateSubnet2Id: { Type: AWS::EC2::Subnet::Id }
2626
VpcPrivateSubnet3Id: { Type: AWS::EC2::Subnet::Id }
27-
KinesisStreamsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
28-
StsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
2927
SharedMemcachedEndpointAddress: { Type: String }
3028
AmazonSesSmtpCredentialsGeneratorServiceToken: { Type: String }
3129
SharedEcsAsgInstanceSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
@@ -195,8 +193,6 @@ Resources:
195193
VpcPrivateSubnet1Id: !Ref VpcPrivateSubnet1Id
196194
VpcPrivateSubnet2Id: !Ref VpcPrivateSubnet2Id
197195
VpcPrivateSubnet3Id: !Ref VpcPrivateSubnet3Id
198-
KinesisStreamsEndpointAccessSecurityGroupId: !Ref KinesisStreamsEndpointAccessSecurityGroupId
199-
StsEndpointAccessSecurityGroupId: !Ref StsEndpointAccessSecurityGroupId
200196
ArrangementsDynamodbRegion: !Sub /prx/${EnvironmentTypeAbbreviation}/dovetail-cdn-arranger/ARRANGEMENTS_DDB_REGION
201197
ArrangementsDynamodbTableName: !Sub /prx/${EnvironmentTypeAbbreviation}/dovetail-cdn-arranger/ARRANGEMENTS_DDB_TABLE
202198
ArrangementsDynamodbAccessRoleArn: !Sub /prx/${EnvironmentTypeAbbreviation}/dovetail-cdn-arranger/ARRANGEMENTS_DDB_ACCESS_ROLE

‎spire/templates/apps-200A.yml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,6 @@ Parameters:
3939
AmazonSesSmtpCredentialsGeneratorServiceToken: { Type: String }
4040
EchoServiceToken: { Type: String }
4141
TransferServerIpFinderServiceToken: { Type: String }
42-
EcsLaunchEndpointsAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
43-
SystemManagerEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
44-
KmsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
45-
CloudWatchEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
46-
EventBridgeEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
4742
SharedEcsAsgInstanceSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
4843
SharedMysqlClientSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
4944
S3SigningUserName: { Type: String }
@@ -206,9 +201,6 @@ Resources:
206201
TransferServerIpFinderServiceToken: !Ref TransferServerIpFinderServiceToken
207202
S3SigningEndpointUrl: !Ref S3SigningEndpointUrl
208203
S3SigningAccessKeyId: !Ref S3SigningAccessKeyId
209-
SystemManagerEndpointAccessSecurityGroupId: !Ref SystemManagerEndpointAccessSecurityGroupId
210-
CloudWatchEndpointAccessSecurityGroupId: !Ref CloudWatchEndpointAccessSecurityGroupId
211-
EventBridgeEndpointAccessSecurityGroupId: !Ref EventBridgeEndpointAccessSecurityGroupId
212204
SharedMysqlClientSecurityGroupId: !Ref SharedMysqlClientSecurityGroupId
213205
SharedMemcachedEndpointAddress: !Ref SharedMemcachedEndpointAddress
214206
SharedMemcachedEndpointPort: !Ref SharedMemcachedEndpointPort
@@ -369,8 +361,6 @@ Resources:
369361
SharedMemcachedEndpointAddress: !Ref SharedMemcachedEndpointAddress
370362
SharedMemcachedEndpointPort: !Ref SharedMemcachedEndpointPort
371363
EchoServiceToken: !Ref EchoServiceToken
372-
EcsLaunchEndpointsAccessSecurityGroupId: !Ref EcsLaunchEndpointsAccessSecurityGroupId
373-
KmsEndpointAccessSecurityGroupId: !Ref KmsEndpointAccessSecurityGroupId
374364
SharedMysqlClientSecurityGroupId: !Ref SharedMysqlClientSecurityGroupId
375365
SharedAuroraMysqlEndpoint: !Ref SharedAuroraMysqlEndpoint
376366
SharedAuroraMysqlPort: !Ref SharedAuroraMysqlPort

‎spire/templates/apps-300A.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ Parameters:
2525
VpcPublicSubnet1Id: { Type: AWS::EC2::Subnet::Id }
2626
VpcPublicSubnet2Id: { Type: AWS::EC2::Subnet::Id }
2727
VpcPublicSubnet3Id: { Type: AWS::EC2::Subnet::Id }
28-
EcsLaunchEndpointsAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
29-
KmsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
3028
DeploymentPackageBucketName: { Type: String }
3129
EchoServiceToken: { Type: String }
3230
SharedEcsAsgInstanceSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
@@ -103,8 +101,6 @@ Resources:
103101
VpcPublicSubnet1Id: !Ref VpcPublicSubnet1Id
104102
VpcPublicSubnet2Id: !Ref VpcPublicSubnet2Id
105103
VpcPublicSubnet3Id: !Ref VpcPublicSubnet3Id
106-
EcsLaunchEndpointsAccessSecurityGroupId: !Ref EcsLaunchEndpointsAccessSecurityGroupId
107-
KmsEndpointAccessSecurityGroupId: !Ref KmsEndpointAccessSecurityGroupId
108104
SharedAppRedisEndpointAddress: !Ref SharedAppRedisEndpointAddress
109105
SharedAppRedisEndpointPort: !Ref SharedAppRedisEndpointPort
110106
SharedAuroraPostgresqlEndpoint: !Ref SharedAuroraPostgresqlEndpoint

‎spire/templates/apps/augury.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,6 @@ Parameters:
4343
VpcPublicSubnet1Id: { Type: AWS::EC2::Subnet::Id }
4444
VpcPublicSubnet2Id: { Type: AWS::EC2::Subnet::Id }
4545
VpcPublicSubnet3Id: { Type: AWS::EC2::Subnet::Id }
46-
EcsLaunchEndpointsAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
47-
KmsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
4846
SharedAppRedisEndpointAddress: { Type: String }
4947
SharedAppRedisEndpointPort: { Type: String }
5048
SharedAuroraPostgresqlEndpoint: { Type: String }
@@ -1174,8 +1172,6 @@ Resources:
11741172
VPC_SUBNET_2: !Ref VpcPublicSubnet2Id
11751173
VPC_SUBNET_3: !Ref VpcPublicSubnet3Id
11761174
SECURITY_GROUP_1: !GetAtt SlowWorkerSecurityGroup.GroupId
1177-
SECURITY_GROUP_2: !Ref EcsLaunchEndpointsAccessSecurityGroupId
1178-
SECURITY_GROUP_3: !Ref KmsEndpointAccessSecurityGroupId
11791175
# Using the combined legacy clickhouse + castle security groups for
11801176
# now to overcome the security group limit.
11811177
SECURITY_GROUP_4: !Ref ClickhouseLegacyClientSecurityGroupId

‎spire/templates/apps/dovetail-counts.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ Parameters:
2525
VpcPrivateSubnet1Id: { Type: AWS::EC2::Subnet::Id }
2626
VpcPrivateSubnet2Id: { Type: AWS::EC2::Subnet::Id }
2727
VpcPrivateSubnet3Id: { Type: AWS::EC2::Subnet::Id }
28-
KinesisStreamsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
29-
StsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
3028
ArrangementsDynamodbRegion: { Type: AWS::SSM::Parameter::Value<String> }
3129
ArrangementsDynamodbTableName: { Type: AWS::SSM::Parameter::Value<String> }
3230
ArrangementsDynamodbAccessRoleArn: { Type: AWS::SSM::Parameter::Value<String> }
@@ -131,8 +129,6 @@ Resources:
131129
# Ipv6AllowedForDualStack: true
132130
SecurityGroupIds:
133131
- !GetAtt CountsFunctionSecurityGroup.GroupId
134-
- !Ref KinesisStreamsEndpointAccessSecurityGroupId
135-
- !Ref StsEndpointAccessSecurityGroupId
136132
- !Ref DovetailRedisClientSecurityGroupId
137133
SubnetIds:
138134
- !Ref VpcPrivateSubnet1Id

‎spire/templates/apps/exchange.yml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,6 @@ Parameters:
5353
TransferServerIpFinderServiceToken: { Type: String }
5454
S3SigningEndpointUrl: { Type: String }
5555
S3SigningAccessKeyId: { Type: String }
56-
SystemManagerEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
57-
CloudWatchEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
58-
EventBridgeEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
5956
SharedMysqlClientSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
6057
SharedMemcachedEndpointAddress: { Type: String }
6158
SharedMemcachedEndpointPort: { Type: String }
@@ -1480,9 +1477,6 @@ Resources:
14801477
SecurityGroupIds:
14811478
- !GetAtt FtpServerAuthorizerFunctionSecurityGroup.GroupId
14821479
- !Ref SharedMysqlClientSecurityGroupId
1483-
- !Ref SystemManagerEndpointAccessSecurityGroupId
1484-
- !Ref CloudWatchEndpointAccessSecurityGroupId
1485-
- !Ref EventBridgeEndpointAccessSecurityGroupId
14861480
SubnetIds:
14871481
- !Ref VpcPrivateSubnet1Id
14881482
- !Ref VpcPrivateSubnet2Id

‎spire/templates/apps/networks.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,6 @@ Parameters:
4747
SharedMemcachedEndpointAddress: { Type: String }
4848
SharedMemcachedEndpointPort: { Type: String }
4949
EchoServiceToken: { Type: String }
50-
EcsLaunchEndpointsAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
51-
KmsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
5250
SharedMysqlClientSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
5351
SharedAuroraMysqlEndpoint: { Type: String }
5452
SharedAuroraMysqlPort: { Type: String }
@@ -670,8 +668,6 @@ Resources:
670668
AwsvpcConfiguration:
671669
SecurityGroups:
672670
- !GetAtt SphinxServerSecurityGroup.GroupId
673-
- !Ref EcsLaunchEndpointsAccessSecurityGroupId
674-
- !Ref KmsEndpointAccessSecurityGroupId
675671
- !Ref SharedMysqlClientSecurityGroupId
676672
AssignPublicIp: DISABLED
677673
Subnets:

‎spire/templates/root.yml‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -413,10 +413,6 @@ Resources:
413413
SharedMysqlClientSecurityGroupId: !GetAtt SharedDatabaseSecurityGroupsStack.Outputs.SharedMysqlClientSecurityGroupId
414414
SharedPostgresqlClientSecurityGroupId: !GetAtt SharedDatabaseSecurityGroupsStack.Outputs.SharedPostgresqlClientSecurityGroupId
415415
SharedClickhouseClientSecurityGroupId: !GetAtt SharedClickhouseSecurityGroupStack.Outputs.ClientSecurityGroupId
416-
EcsLaunchEndpointsAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.EcsLaunchEndpointsAccessSecurityGroupId
417-
KmsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.KmsEndpointAccessSecurityGroupId
418-
StsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.StsEndpointAccessSecurityGroupId
419-
EventBridgeEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.EventBridgeEndpointAccessSecurityGroupId
420416
DovetailRedisClientSecurityGroupId: !GetAtt SharedRedisSecurityGroupStack.Outputs.ClientSecurityGroupId
421417
DovetailRedisReplicationGroupEndpointAddress: !GetAtt SharedRedisStack.Outputs.ValkeyReplicationGroupEndpointAddress
422418
DovetailRedisReplicationGroupEndpointPort: !GetAtt SharedRedisStack.Outputs.ValkeyReplicationGroupEndpointPort
@@ -451,10 +447,6 @@ Resources:
451447
SharedMysqlClientSecurityGroupId: !GetAtt SharedDatabaseSecurityGroupsStack.Outputs.SharedMysqlClientSecurityGroupId
452448
SharedPostgresqlClientSecurityGroupId: !GetAtt SharedDatabaseSecurityGroupsStack.Outputs.SharedPostgresqlClientSecurityGroupId
453449
SharedClickhouseClientSecurityGroupId: !GetAtt SharedClickhouseSecurityGroupStack.Outputs.ClientSecurityGroupId
454-
EcsLaunchEndpointsAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.EcsLaunchEndpointsAccessSecurityGroupId
455-
KmsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.KmsEndpointAccessSecurityGroupId
456-
StsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.StsEndpointAccessSecurityGroupId
457-
EventBridgeEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.EventBridgeEndpointAccessSecurityGroupId
458450
DovetailRedisClientSecurityGroupId: !GetAtt SharedRedisSecurityGroupStack.Outputs.ClientSecurityGroupId
459451
DovetailRedisReplicationGroupEndpointAddress: !GetAtt SharedRedisStack.Outputs.ValkeyReplicationGroupEndpointAddress
460452
DovetailRedisReplicationGroupEndpointPort: !GetAtt SharedRedisStack.Outputs.ValkeyReplicationGroupEndpointPort
@@ -653,8 +645,6 @@ Resources:
653645
RootStackName: !Ref AWS::StackName
654646
VpcPublicSubnet1Id: !GetAtt SharedVpcStack.Outputs.PublicSubnet1Id
655647
SharedClickhouseInstanceSecurityGroupId: !GetAtt SharedClickhouseSecurityGroupStack.Outputs.InstanceSecurityGroupId
656-
CloudWatchLogsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.CloudWatchLogsEndpointAccessSecurityGroupId
657-
CloudWatchEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.CloudWatchEndpointAccessSecurityGroupId
658648
Tags:
659649
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
660650
- { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
@@ -691,8 +681,6 @@ Resources:
691681
VpcPrivateSubnet1Id: !GetAtt SharedVpcStack.Outputs.PrivateSubnet1Id
692682
VpcPrivateSubnet2Id: !GetAtt SharedVpcStack.Outputs.PrivateSubnet2Id
693683
VpcPrivateSubnet3Id: !GetAtt SharedVpcStack.Outputs.PrivateSubnet3Id
694-
KinesisStreamsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.KinesisStreamsEndpointAccessSecurityGroupId
695-
StsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.StsEndpointAccessSecurityGroupId
696684
SharedMemcachedEndpointAddress: !GetAtt SharedMemcachedStack.Outputs.CacheEndpointAddress
697685
DovetailRedisClientSecurityGroupId: !GetAtt SharedRedisSecurityGroupStack.Outputs.ClientSecurityGroupId
698686
DovetailRedisReplicationGroupEndpointAddress: !GetAtt SharedRedisStack.Outputs.ValkeyReplicationGroupEndpointAddress
@@ -783,11 +771,6 @@ Resources:
783771
AmazonSesSmtpCredentialsGeneratorServiceToken: !GetAtt CustomResourcesStack.Outputs.AmazonSesSmtpCredentialsGeneratorServiceToken
784772
EchoServiceToken: !GetAtt CustomResourcesStack.Outputs.EchoServiceToken
785773
TransferServerIpFinderServiceToken: !GetAtt CustomResourcesStack.Outputs.TransferServerIpFinderServiceToken
786-
EcsLaunchEndpointsAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.EcsLaunchEndpointsAccessSecurityGroupId
787-
SystemManagerEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.SystemManagerEndpointAccessSecurityGroupId
788-
KmsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.KmsEndpointAccessSecurityGroupId
789-
CloudWatchEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.CloudWatchEndpointAccessSecurityGroupId
790-
EventBridgeEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.EventBridgeEndpointAccessSecurityGroupId
791774
SharedEcsAsgInstanceSecurityGroupId: !GetAtt SharedEcsAsgSecurityGroupStack.Outputs.InstanceSecurityGroupId
792775
SharedMysqlClientSecurityGroupId: !GetAtt SharedDatabaseSecurityGroupsStack.Outputs.SharedMysqlClientSecurityGroupId
793776
S3SigningUserName: !GetAtt Apps100AStack.Outputs.S3SigningUserName
@@ -876,8 +859,6 @@ Resources:
876859
VpcPublicSubnet1Id: !GetAtt SharedVpcStack.Outputs.PublicSubnet1Id
877860
VpcPublicSubnet2Id: !GetAtt SharedVpcStack.Outputs.PublicSubnet2Id
878861
VpcPublicSubnet3Id: !GetAtt SharedVpcStack.Outputs.PublicSubnet3Id
879-
EcsLaunchEndpointsAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.EcsLaunchEndpointsAccessSecurityGroupId
880-
KmsEndpointAccessSecurityGroupId: !GetAtt SharedVpcStack.Outputs.KmsEndpointAccessSecurityGroupId
881862
DeploymentPackageBucketName: !GetAtt Constants2.Outputs.DeploymentPackageBucketName
882863
EchoServiceToken: !GetAtt CustomResourcesStack.Outputs.EchoServiceToken
883864
SharedEcsAsgInstanceSecurityGroupId: !GetAtt SharedEcsAsgSecurityGroupStack.Outputs.InstanceSecurityGroupId

‎spire/templates/shared-clickhouse/instance.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ Parameters:
2525
RootStackName: { Type: String }
2626
VpcPublicSubnet1Id: { Type: AWS::EC2::Subnet::Id }
2727
SharedClickhouseInstanceSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
28-
CloudWatchLogsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
29-
CloudWatchEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
3028

3129
Conditions:
3230
EnableNestedChangeSetScrubbingResources: !Equals [!Ref NestedChangeSetScrubbingResourcesState, Enabled]
@@ -287,8 +285,6 @@ Resources:
287285
DeviceIndex: 0
288286
GroupSet:
289287
- !Ref SharedClickhouseInstanceSecurityGroupId
290-
- !Ref CloudWatchLogsEndpointAccessSecurityGroupId
291-
- !Ref CloudWatchEndpointAccessSecurityGroupId
292288
SubnetId: !Ref VpcPublicSubnet1Id
293289
Tags:
294290
- { Key: Name, Value: !Sub "${RootStackName}-clickhouse_server" }

‎spire/templates/shared-ecs/asg-aarch64.yml‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,6 @@ Parameters:
3232
SharedMysqlClientSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
3333
SharedPostgresqlClientSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
3434
SharedClickhouseClientSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
35-
EcsLaunchEndpointsAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
36-
KmsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
37-
StsEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
38-
EventBridgeEndpointAccessSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
3935
DovetailRedisClientSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
4036
DovetailRedisReplicationGroupEndpointAddress: { Type: String }
4137
DovetailRedisReplicationGroupEndpointPort: { Type: String }
@@ -155,10 +151,6 @@ Resources:
155151
DeviceIndex: 0
156152
Groups:
157153
- !Ref SharedEcsAsgInstanceSecurityGroupId
158-
- !Ref EcsLaunchEndpointsAccessSecurityGroupId
159-
- !Ref KmsEndpointAccessSecurityGroupId
160-
- !Ref StsEndpointAccessSecurityGroupId
161-
- !Ref EventBridgeEndpointAccessSecurityGroupId
162154
- !Ref SharedMysqlClientSecurityGroupId
163155
- !Ref SharedPostgresqlClientSecurityGroupId
164156
- !Ref DovetailRedisClientSecurityGroupId

0 commit comments

Comments
 (0)