I think we might take this opportunity to simplify the class diagram of the whole SecurityGroup business somewhat.

Requirements:

machine.connections.allowTo(securityGroup);
machine.connections.allowTo(machine);
machine.connections.allowTo(new AnyIPv4());
machine.connections.allowTo(new DynamoDBInYourVPC());

And other securitygroups or things with securitygroups need to reciprocate connectability whenever that makes sense.

Current state

Right now it looks like this:

                                                                                                                      
                            ┌──────────────────────────────────────────────────────has────────────────┐               
                            │                                                                         │               
                            ▼                                                                         │               
                 ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐        ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐                               │               
                     IConnectionPeer                 IConnectable                                     │               
                 │                     │        │                     │                               │               
                  + toIngressRuleJSON()              + connections     ───────has──────────────┐      │               
                 │+ toEgressRuleJSON() │        │                     │                        │      │               
                  ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─          ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─                         │      │               
                          △ △                              △                                   │      │               
                          │ │                              │                                   │      │               
                          │ │                              │                                   │      │               
              ┌───────────┘ └──────────────────┬───────────┘                                   │      │               
              │                                │                                               │      │               
              │                                │                                               │      │               
              │                                │                                               │      │               
              │                                │                                               ▼      │               
┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐       ╔═════════════════════╗             ┌────────────────────────────────────────────┐
       ISecurityGroup               ║                     ║██           │                Connections                 │
│                           │       ║       CidrIp        ║██           │                                            │
   + addIngressRule(peer)           ║       AnyIPv4       ║██           │             + defaultPortRange             │
│   + addEgressRule(peer)   │       ║      CidrIPv6       ║██           │                                            │
 ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─        ║       AnyIPv6       ║██           │           + allowTo(connectable)           │
              △                     ║     PrefixList      ║██           │          + allowFrom(connectable)          │
              │                     ║                     ║██           │                                            │
              │                     ╚═════════════════════╝██           │     + allowToDefaultPort(connectable)      │
   ┌─────────────────────┐            ███████████████████████           │    + allowFromDefaultPort(connectable)     │
   │  SecurityGroupRef   │                                              │       + allowInternally(connectable)       │
   │                     │                                              │       + allowToAnyIPv4(connectable)        │
   │  + securityGroupId  │                                              │      + allowFromAnyIPv4(connectable)       │
   └─────────────────────┘                                              │    + allowDefaultPortFrom(connectable)     │
              △                                                         │     + allowDefaultPortTo(connectable)      │
              │                                                         │ + allowDefaultPortInternally(connectable)  │
              │                                                         │ + allowDefaultPortFromAnyIPv4(connectable) │
   ┌─────────────────────┐                                              │                                            │
   │                     │                                              └────────────────────────────────────────────┘
   │    SecurityGroup    │                                                                                            
   │                     │                                                                                            
   └─────────────────────┘

Simple

The simplest thing we could do this the following:

                            ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐                    
                                    IConnectionPeer                            
                            │                             │                    
                                 + toIngressRuleJSON()                         
                            │    + toEgressRuleJSON()     │                    
                                + allowTo(connectable)                         
                            │  + allowFrom(connectable)   │                    
                                    + canInlineRule                            
                            │     + defaultPortRange      │                    
                             ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─                     
                                           △                                   
                                           │                                   
                      ┌────────────────────┴─────────────────────┐             
                      │                                          │             
                      │                                          │             
┌───────────────────────────────────────────┐       ┌─────────────────────────┐
│             SecurityGroupRef              │       │                         │
│                                           │       │  SecurityGrouplessPeer  │
│             + securityGroupId             │       │                         │
│            + defaultPortRange             │       └─────────────────────────┘
│                                           │                    △             
│        + allowToDefaultPort(peer)         │                    │             
│       + allowFromDefaultPort(peer)        │                    │             
│          + allowInternally(peer)          │         ╔═════════════════════╗  
│          + allowToAnyIPv4(peer)           │         ║                     ║██
│         + allowFromAnyIPv4(peer)          │         ║       CidrIp        ║██
│       + allowDefaultPortFrom(peer)        │         ║       AnyIPv4       ║██
│        + allowDefaultPortTo(peer)         │         ║      CidrIPv6       ║██
│    + allowDefaultPortInternally(peer)     │         ║       AnyIPv6       ║██
└───────────────────────────────────────────┘         ║     PrefixList      ║██
                      △                               ║                     ║██
                      │                               ╚═════════════════════╝██
                      │                                 ███████████████████████
                      │                                                        
           ┌─────────────────────┐                                             
           │                     │                                             
           │    SecurityGroup    │                                             
           │                     │                                             
           └─────────────────────┘

This has the following downsides:

ConnectionPeers and things-with-ConnectionPeers are no longer interchangeable. We now have to write:

machine1.securityGroup.allowTo(machine1.securityGroup);

// Instead of
machine1.connections.allowTo(machine1);

SecurityGroupRef now has to be aware of defaultPortRange, which we have to pass upon constructing it. This is not technically correct; the services inside the SG have default port range, not the SG itself. Does not make sense when we have multiple services inside an SG, and also leads to a construction order problem with (for example) RDS clusters, where the dependency chain would be: securityGroup ==(defaultPortRange)==> RDSCluster ==(to create)==> securityGroup. Resolvable with Tokens, but not nice.

Hard to allow connections to/from a plain SecurityGroup object #579

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions