Skip to content

Move admin SSH CIDR to a variable and add it as an output #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
irvingpop merged 2 commits into from
Oct 30, 2026
Merged

Move admin SSH CIDR to a variable and add it as an output #191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
27a0395
Move admin SSH CIDR to a variable and add it as an output
irvingpop Oct 30, 2026
f4779bd
Validate admin_ssh_cidr is a single IPv4 /32
irvingpop Oct 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion terraform/asg.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,11 @@ output "ecs_ami_name" {
value = local.ecs_ami["image_name"]
}

output "admin_ssh_cidr" {
description = "CIDR allowed to SSH to the ECS instances"
value = var.admin_ssh_cidr

@github-actions github-actions Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

low security, confidence low, pass security

Admin IP exposed via Terraform output

The output prints the admin SSH CIDR to the CLI, to CI logs and to remote state readers. This partly defeats the goal of keeping the admin IP out of public view. The exposure is minor, since the value is a single allowlisted IP and not a credential. An attacker would need access to the logs or the state.

Model output from untrusted input. Check it before you act on it.

}

# https://registry.terraform.io/modules/terraform-aws-modules/autoscaling/aws/latest
module "autoscaling" {
source = "terraform-aws-modules/autoscaling/aws"
Expand Down Expand Up @@ -150,7 +155,7 @@ module "autoscaling_sg" {
ingress_with_cidr_blocks = [
{
rule = "ssh-tcp"
cidr_blocks = "71.237.173.68/32"
cidr_blocks = var.admin_ssh_cidr

@github-actions github-actions Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

low bug, confidence medium, pass review

No validation of CIDR format in required variable

The variable is a bare string with no validation block. An empty or malformed value (for example an unset tfvars entry set to an empty string) will only fail at apply time inside the AWS API, or could yield an unintended rule. A validation using cidrhost or can(cidrnetmask) would catch this at plan time.

Model output from untrusted input. Check it before you act on it.

}
]

Expand Down
9 changes: 9 additions & 0 deletions terraform/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
variable "admin_ssh_cidr" {
description = "CIDR allowed to SSH to the ECS instances. Set in terraform.tfvars, which git ignores."
type = string

@github-actions github-actions Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

low security, confidence low, pass security

No validation on SSH CIDR variable

admin_ssh_cidr accepts any string and feeds the security group SSH ingress rule. An operator could set 0.0.0.0/0 by mistake, which would expose SSH to the internet. The input comes from the operator's tfvars, so the impact is limited, but a validation block could reject overly broad ranges. The old value was a fixed /32.

Model output from untrusted input. Check it before you act on it.


validation {
condition = can(cidrhost(var.admin_ssh_cidr, 0)) && endswith(var.admin_ssh_cidr, "/32")
error_message = "admin_ssh_cidr must be a single IPv4 address in CIDR form, such as 203.0.113.10/32."
}
}
Loading