updating a prefix list at AWS when a task boots

entry-point.sh

# i'm running cloudflare RailGun in a Fargate task, in a public subnet, with a public IP address.
# i need to ensure the web servers do not allow public access; only access from this Fargate task or CloudFlare's IPs
# this presents an interesting problem: Fargate tasks can't use Elastic IPs, so the IP will change each time a task runs,
# making security groups tough

# what i do is:
# create a prefix list (this is a list of IP addresses at AWS)
# add a security group called web_railgun that uses the prefix list; attach that security group to the load balancer
# replace the IP address (cidr) entry in the prefix list when the task boots

if [ "$UPDATE_MANAGED_PREFIX_LIST" != "" ]; then
  prefix_list_version=`aws ec2 describe-managed-prefix-lists --filters Name=prefix-list-id,Values=$UPDATE_MANAGED_PREFIX_LIST | jq '.PrefixLists[].Version' --raw-output`
  for cidr in `aws ec2 get-managed-prefix-list-entries --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST | jq '.Entries[].Cidr' --raw-output`; do
    aws ec2 modify-managed-prefix-list --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST --current-version $prefix_list_version --remove-entries Cidr=$cidr
    prefix_list_version=`aws ec2 describe-managed-prefix-lists --filters Name=prefix-list-id,Values=$UPDATE_MANAGED_PREFIX_LIST | jq '.PrefixLists[].Version' --raw-output`
  done
  my_ip=`curl http://icanhazip.com`
  aws ec2 modify-managed-prefix-list --prefix-list-id $UPDATE_MANAGED_PREFIX_LIST --current-version $prefix_list_version --add-entries Cidr=$my_ip/32,Description=fargate
fi

lb.tf

# terraform config for the load balancer and security groups

resource "aws_lb" "lb" {
  name               = var.env_name
  internal           = false
  load_balancer_type = "application"
  subnets            = aws_subnet.app_public.*.id
  security_groups    = [aws_security_group.web.id,aws_security_group.web_railgun.id]
  enable_cross_zone_load_balancing = true
  idle_timeout       = 180

  tags = {
    Name = var.env_name
  }
}

resource "aws_security_group" "web_railgun" {
  name        = "${var.env_name}-allow_http_railgun"
  description = "Allow HTTP traffic from Railgun"
  vpc_id      = "${aws_vpc.app.id}"
}

resource "aws_security_group_rule" "https_ingress_railgun" {
  type            = "ingress"
  from_port       = 443
  to_port         = 443
  protocol        = "6"
  prefix_list_ids = [var.railgun_prefix_list_id]

  security_group_id = aws_security_group.web_railgun.id
}

resource "aws_security_group_rule" "http_ingress_railgun" {
  type            = "ingress"
  from_port       = 80
  to_port         = 80
  protocol        = "6"
  prefix_list_ids = [var.railgun_prefix_list_id]

  security_group_id = aws_security_group.web_railgun.id
}

prefix-list.tf

# there is no way to create a managed prefix list in Terraform
# just go to the console under VPCs and create one
# its ID is used for the railgun_prefix_list_id Terraform variable and the UPDATE_MANAGED_PREFIX_LIST env variable