Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixing table and code block formatting in runbook #6615

Merged
merged 1 commit into from
Dec 20, 2024
Merged

Fixing table and code block formatting in runbook #6615

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions runbooks/source/block-public-ip-address.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,14 @@ review_in: 6 months
By default, the [network access control list] is configured to allow all traffic to flow in and out of the subnets with which it is associated. Currently in our evironment, the public subnets are associated with network ACL with the following default rules:

**Inbound rules**

| Rule # | Type | Protocol | Port range | Source | Allow/Deny |
|--------|------------------|----------|------------|-----------|------------|
| 100 | All IPv4 traffic | All | All | 0.0.0.0/0 | ALLOW |
| * | All IPv4 traffic | All | All | 0.0.0.0/0 | DENY |

**Outbound rules**

| Rule number | Type | Protocol | Port range | Destination | Allow/Deny |
|---------------|-------------|------------|--------------|-----------------|-------------|
| 100 | All traffic | All | All | 0.0.0.0/0 | Allow |
Expand All @@ -37,6 +39,7 @@ Steps to add deny rules:
**N.B** The `rule_number` needs to be less than `100` in order for the deny rule to take precedence over the default _Allow All_ rule.

It should look like the following:

```
resource "aws_network_acl_rule" "deny_inbound_1" {
network_acl_id = module.vpc.public_network_acl_id
Expand All @@ -63,13 +66,15 @@ resource "aws_network_acl_rule" "deny_outbound_1" {
4. Raise a PR and merge. The infrastructure pipelines in Concourse will create the new ACL rules in the public network ACL. You can verify the rules have been created by viewing the public network ACL in the AWS console. It will look like the following:

**Inbound rules**

| Rule number | Type | Protocol | Port range | Source | Allow/Deny |
|---------------|-------------|------------|--------------|-----------------|-------------|
| 10 | All traffic | All | All | ##.##.##.##/32 | Deny |
| 100 | All traffic | All | All | 0.0.0.0/0 | Allow |
| * | All traffic | All | All | 0.0.0.0/0 | Deny |

**Outbound rules**

| Rule number | Type | Protocol | Port range | Destination | Allow/Deny |
|---------------|-------------|------------|--------------|-----------------|-------------|
| 10 | All traffic | All | All | ##.##.##.##/32 | Deny |
Expand Down
Loading