Skip to content

Added check for MWAA WebServerAccessMode #173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Added check for MWAA WebServerAccessMode #173

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
175d2b4
Added check for MWAA WebServerAccessMode
animetauren Jun 18, 2021
03b19d6
Fixed missing reference to environment var
animetauren Jun 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions MWAA/verify_env/verify_env.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,10 +494,11 @@ def prompt_user_and_print_info(input_env_name, ec2_client):
)['Environment']
network_subnet_ids = environment['NetworkConfiguration']['SubnetIds']
network_subnets = ec2_client.describe_subnets(SubnetIds=network_subnet_ids)['Subnets']
WebserverAccessMode = environment['Environment']['WebserverAccessMode']
for key in environment.keys():
print(key, ': ', environment[key])
print('VPC: ', network_subnets[0]['VpcId'], "\n")
return environment, network_subnets, network_subnet_ids
return environment, network_subnets, network_subnet_ids, WebserverAccessMode


def check_kms_key_policy(input_env, kms_client):
Expand Down Expand Up @@ -698,7 +699,7 @@ def check_service_vpc_endpoints(ec2_client, subnets):
print("The route for the subnets do not have a NAT Gateway. However, there are sufficient VPC endpoints")


def check_routes(input_env, input_subnets, input_subnet_ids, ec2_client):
def check_routes(input_env, input_subnets, input_subnet_ids, ec2_client, input_access_mode):
'''
method to check and make sure routes have access to the internet if public and subnets are private
'''
Expand Down Expand Up @@ -734,6 +735,10 @@ def check_routes(input_env, input_subnets, input_subnet_ids, ec2_client):
print('Route Table:', route_table['RouteTableId'], 'does not have a route to a NAT Gateway')
print('checking for VPC endpoints to airflow, s3, sqs, kms, ecr, and monitoring')
check_service_vpc_endpoints(ec2_client, input_subnets)
if input_access_mode == 'PRIVATE_ONLY':
print('MWAA WebServer AccessMode: Web Server Access is Private Only')
print('checking for VPC endpoints to airflow, s3, sqs, kms, ecr, and monitoring')
check_service_vpc_endpoints(ec2_client, input_subnets)
print("")


Expand Down Expand Up @@ -971,12 +976,12 @@ def get_mwaa_utilized_services(ec2_client, vpc):
cloudtrail = boto3.client('cloudtrail', region_name=REGION)
ssm = boto3.client('ssm', region_name=REGION)
iam = boto3.client('iam', region_name=REGION)
env, subnets, subnet_ids = prompt_user_and_print_info(ENV_NAME, ec2)
env, subnets, subnet_ids, access_mode = prompt_user_and_print_info(ENV_NAME, ec2)
check_iam_permissions(env, iam)
check_kms_key_policy(env, kms)
log_groups = check_log_groups(env, ENV_NAME, logs, cloudtrail)
check_nacl(subnets, subnet_ids, ec2)
check_routes(env, subnets, subnet_ids, ec2)
check_routes(env, subnets, subnet_ids, ec2, access_mode)
check_s3_block_public_access(env, s3, s3control)
check_security_groups(env, ec2)
mwaa_services = get_mwaa_utilized_services(ec2, subnets[0]['VpcId'])
Expand Down