Examples with SecurityGroup software.amazon.awssdk.services.ec2.model.SecurityGroup used on opensource projects

Example 6 with SecurityGroup

use of software.amazon.awssdk.services.ec2.model.SecurityGroup in project photon-model by vmware.

the class TestAWSSecurityGroupService method testAllocateSecurityGroupUpdate.

/*
     * update an existing security group to the required default ports
     */
@Test
public void testAllocateSecurityGroupUpdate() throws Throwable {
    String groupId = this.client.createDefaultSecurityGroup(null);
    List<IpPermission> rules = new ArrayList<>();
    IpRange ipRange = new IpRange().withCidrIp(DEFAULT_ALLOWED_NETWORK);
    rules.add(new IpPermission().withIpProtocol(DEFAULT_PROTOCOL).withFromPort(22).withToPort(22).withIpv4Ranges(ipRange));
    this.client.addIngressRules(groupId, rules);
    SecurityGroup updatedGroup = this.client.getDefaultSecurityGroup(null);
    validateDefaultRules(updatedGroup.getIpPermissions());
    this.client.deleteSecurityGroup(groupId);
}

Example 7 with SecurityGroup

use of software.amazon.awssdk.services.ec2.model.SecurityGroup in project photon-model by vmware.

the class AWSUtils method getOrCreateSecurityGroups.

/*
     * method will create new or validate existing security group has the necessary settings for CM
     * to function. It will return the security group id that is required during instance
     * provisioning. for each nicContext element provided, for each of its securityGroupStates,
     * security group is discovered from AWS in case that there are no securityGroupStates, security
     * group ID is obtained from the custom properties in case that none of the above methods
     * discover a security group, the default one is discovered from AWS in case that none of the
     * above method discover a security group, a new security group is created
     */
public static List<String> getOrCreateSecurityGroups(AWSInstanceContext aws, AWSNicContext nicCtx) {
    String groupId;
    SecurityGroup group;
    List<String> groupIds = new ArrayList<>();
    AWSSecurityGroupClient client = new AWSSecurityGroupClient(aws.amazonEC2Client);
    if (nicCtx != null) {
        if (nicCtx.securityGroupStates != null && !nicCtx.securityGroupStates.isEmpty()) {
            List<String> securityGroupNames = nicCtx.securityGroupStates.stream().map(securityGroupState -> securityGroupState.name).collect(Collectors.toList());
            List<SecurityGroup> securityGroups = client.getSecurityGroups(new ArrayList<>(securityGroupNames), nicCtx.vpc.getVpcId());
            for (SecurityGroup securityGroup : securityGroups) {
                groupIds.add(securityGroup.getGroupId());
            }
            return groupIds;
        }
    }
    // use the security group provided in the description properties
    String sgId = getFromCustomProperties(aws.child.description, AWSConstants.AWS_SECURITY_GROUP_ID);
    if (sgId != null) {
        return Arrays.asList(sgId);
    }
    // in case no group is configured in the properties, attempt to discover the default one
    if (nicCtx != null && nicCtx.vpc != null) {
        try {
            group = client.getSecurityGroup(DEFAULT_SECURITY_GROUP_NAME, nicCtx.vpc.getVpcId());
            if (group != null) {
                return Arrays.asList(group.getGroupId());
            }
        } catch (AmazonServiceException t) {
            if (!t.getMessage().contains(DEFAULT_SECURITY_GROUP_NAME)) {
                throw t;
            }
        }
    }
    // if the group doesn't exist an exception is thrown. We won't throw a
    // missing group exception
    // we will continue and create the group
    groupId = createSecurityGroupOnDefaultVPC(aws);
    return Collections.singletonList(groupId);
}

Example 8 with SecurityGroup

use of software.amazon.awssdk.services.ec2.model.SecurityGroup in project photon-model by vmware.

the class AWSComputeDiskDay2ServiceTest method assertAndSetVMSecurityGroupsToBeDeleted.

private void assertAndSetVMSecurityGroupsToBeDeleted(Instance instance, ComputeState vm) {
    // This assert is only suitable for real (non-mocking env).
    if (this.isMock) {
        return;
    }
    this.host.log(Level.INFO, "%s: Assert security groups configuration for [%s] VM", this.currentTestName.getMethodName(), this.vmState.name);
    // Get the SecurityGroupStates that were provided in the request ComputeState
    Collector<SecurityGroupService.SecurityGroupState, ?, Map<String, SecurityGroupService.SecurityGroupState>> convertToMap = Collectors.<SecurityGroupService.SecurityGroupState, String, SecurityGroupService.SecurityGroupState>toMap(sg -> sg.name, sg -> sg);
    Map<String, SecurityGroupService.SecurityGroupState> currentSGNamesToStates = vm.networkInterfaceLinks.stream().map(nicLink -> this.host.getServiceState(null, NetworkInterfaceService.NetworkInterfaceState.class, UriUtils.buildUri(this.host, nicLink))).<// collect all SecurityGroup States from all NIC states
    SecurityGroupService.SecurityGroupState>flatMap(nicState -> nicState.securityGroupLinks.stream().map(sgLink -> {
        SecurityGroupService.SecurityGroupState sgState = this.host.getServiceState(null, SecurityGroupService.SecurityGroupState.class, UriUtils.buildUri(this.host, sgLink));
        return sgState;
    })).collect(convertToMap);
    // Compare ComputeState after provisioning to the ComputeState in the request
    assertNotNull("Instance should have security groups attached.", instance.getSecurityGroups());
    // Provisioned Instance should have the same number of SecurityGroups as requested
    assertEquals(instance.getSecurityGroups().size(), currentSGNamesToStates.size());
    for (SecurityGroupService.SecurityGroupState currentSGState : currentSGNamesToStates.values()) {
        // Get corresponding requested state
        GroupIdentifier provisionedGroupIdentifier = null;
        for (GroupIdentifier awsGroupIdentifier : instance.getSecurityGroups()) {
            if (awsGroupIdentifier.getGroupId().equals(currentSGState.id)) {
                provisionedGroupIdentifier = awsGroupIdentifier;
                break;
            }
        }
        // Ensure that the requested SecurityGroup was actually provisioned
        assertNotNull(provisionedGroupIdentifier);
        if (currentSGState.name.contains(TestAWSSetupUtils.AWS_NEW_GROUP_PREFIX)) {
            this.sgToCleanUp = currentSGState.id;
            SecurityGroup awsSecurityGroup = getSecurityGroupsIdUsingEC2Client(this.client, provisionedGroupIdentifier.getGroupId());
            assertNotNull(awsSecurityGroup);
            // Validate rules are correctly created as requested
            IpPermission awsIngressRule = awsSecurityGroup.getIpPermissions().get(0);
            IpPermission awsEgressRule = awsSecurityGroup.getIpPermissionsEgress().get(1);
            assertNotNull(awsIngressRule);
            assertNotNull(awsEgressRule);
            assertEquals("Error in created ingress rule", awsIngressRule.getIpProtocol(), currentSGState.ingress.get(0).protocol);
            assertEquals("Error in created ingress rule", awsIngressRule.getIpv4Ranges().get(0).getCidrIp(), currentSGState.ingress.get(0).ipRangeCidr);
            assertEquals("Error in created egress rule", awsEgressRule.getIpProtocol(), currentSGState.egress.get(0).protocol);
            assertEquals("Error in created egress rule", awsEgressRule.getIpv4Ranges().get(0).getCidrIp(), currentSGState.egress.get(0).ipRangeCidr);
        }
    }
}

Example 9 with SecurityGroup

use of software.amazon.awssdk.services.ec2.model.SecurityGroup in project photon-model by vmware.

the class AWSLoadBalancerServiceTest method testCreateUpdateDeleteLoadBalancer.

@Test
public void testCreateUpdateDeleteLoadBalancer() throws Throwable {
    // set name with invalid characters and more than 32 characters
    this.lbName = generateLbName() + "-1234567890-1234567890-1234567890_;.,/";
    LoadBalancerState lb = createLoadBalancerState(this.lbName);
    // Provision load balancer
    kickOffLoadBalancerProvision(InstanceRequestType.CREATE, lb.documentSelfLink, TaskStage.FINISHED);
    lb = getServiceSynchronously(lb.documentSelfLink, LoadBalancerState.class);
    this.lbName = lb.name;
    if (!this.isMock) {
        assertNotNull(lb.securityGroupLinks);
        String securityGroupDocumentSelfLink = lb.securityGroupLinks.iterator().next();
        assertNotNull(securityGroupDocumentSelfLink);
        SecurityGroupState sgs = getServiceSynchronously(securityGroupDocumentSelfLink, SecurityGroupState.class);
        this.sgId = sgs.id;
        LoadBalancerDescription awsLoadBalancer = getAwsLoadBalancer(this.lbName);
        assertNotNull(awsLoadBalancer);
        assertEquals(awsLoadBalancer.getDNSName(), lb.address);
        assertEquals("internet-facing", awsLoadBalancer.getScheme());
        assertEquals(1, awsLoadBalancer.getInstances().size());
        List<ListenerDescription> listeners = awsLoadBalancer.getListenerDescriptions();
        assertEquals(2, listeners.size());
        verifyListeners(lb.routes, listeners);
        verifyHealthCheckConfiguration(lb.routes.get(0), awsLoadBalancer.getHealthCheck());
        SecurityGroup securityGroup = getAwsSecurityGroup(sgs.id);
        assertNotNull(securityGroup);
        String lbSecGroupId = awsLoadBalancer.getSecurityGroups().stream().findFirst().orElse(null);
        assertEquals(securityGroup.getGroupId(), lbSecGroupId);
    }
    // Update load balancer from 1 machines to 2 to simulate scale-out
    if (!this.isMock) {
        lb.computeLinks = new HashSet<>(Arrays.asList(this.cs1.documentSelfLink, this.cs2.documentSelfLink));
        putServiceSynchronously(lb.documentSelfLink, lb);
    }
    kickOffLoadBalancerProvision(InstanceRequestType.UPDATE, lb.documentSelfLink, TaskStage.FINISHED);
    if (!this.isMock) {
        LoadBalancerDescription awsLoadBalancer = getAwsLoadBalancer(this.lbName);
        assertNotNull(awsLoadBalancer);
        assertEquals(2, awsLoadBalancer.getInstances().size());
        // Update load balancer from 2 machines to 1 to simulate scale-in
        lb.computeLinks = Collections.singleton(this.cs1.documentSelfLink);
        putServiceSynchronously(lb.documentSelfLink, lb);
        kickOffLoadBalancerProvision(InstanceRequestType.UPDATE, lb.documentSelfLink, TaskStage.FINISHED);
        awsLoadBalancer = getAwsLoadBalancer(this.lbName);
        assertNotNull(awsLoadBalancer);
        assertEquals(1, awsLoadBalancer.getInstances().size());
    }
    kickOffLoadBalancerProvision(InstanceRequestType.DELETE, lb.documentSelfLink, TaskStage.FINISHED);
    if (!this.isMock) {
        assertNull(getAwsLoadBalancer(this.lbName));
        assertNull(getAwsSecurityGroup(this.sgId));
    }
    this.lbName = null;
    this.sgId = null;
}

Example 10 with SecurityGroup

use of software.amazon.awssdk.services.ec2.model.SecurityGroup in project photon-model by vmware.

the class AWSRebootServiceTest method assertAndSetVMSecurityGroupsToBeDeleted.

private void assertAndSetVMSecurityGroupsToBeDeleted(Instance instance, ComputeState vm) {
    // This assert is only suitable for real (non-mocking env).
    if (this.isMock) {
        return;
    }
    this.host.log(Level.INFO, "%s: Assert security groups configuration for [%s] VM", this.currentTestName.getMethodName(), this.vmState.name);
    // Get the SecurityGroupStates that were provided in the request ComputeState
    Collector<SecurityGroupState, ?, Map<String, SecurityGroupState>> convertToMap = Collectors.<SecurityGroupState, String, SecurityGroupState>toMap(sg -> sg.name, sg -> sg);
    Map<String, SecurityGroupState> currentSGNamesToStates = vm.networkInterfaceLinks.stream().map(nicLink -> this.host.getServiceState(null, NetworkInterfaceState.class, UriUtils.buildUri(this.host, nicLink))).<// collect all SecurityGroup States from all NIC states
    SecurityGroupState>flatMap(nicState -> nicState.securityGroupLinks.stream().map(sgLink -> {
        SecurityGroupState sgState = this.host.getServiceState(null, SecurityGroupState.class, UriUtils.buildUri(this.host, sgLink));
        return sgState;
    })).collect(convertToMap);
    // Compare ComputeState after provisioning to the ComputeState in the request
    assertNotNull("Instance should have security groups attached.", instance.getSecurityGroups());
    // Provisioned Instance should have the same number of SecurityGroups as requested
    assertEquals(instance.getSecurityGroups().size(), currentSGNamesToStates.size());
    for (SecurityGroupState currentSGState : currentSGNamesToStates.values()) {
        // Get corresponding requested state
        GroupIdentifier provisionedGroupIdentifier = null;
        for (GroupIdentifier awsGroupIdentifier : instance.getSecurityGroups()) {
            if (awsGroupIdentifier.getGroupId().equals(currentSGState.id)) {
                provisionedGroupIdentifier = awsGroupIdentifier;
                break;
            }
        }
        // Ensure that the requested SecurityGroup was actually provisioned
        assertNotNull(provisionedGroupIdentifier);
        if (currentSGState.name.contains(TestAWSSetupUtils.AWS_NEW_GROUP_PREFIX)) {
            this.sgToCleanUp = currentSGState.id;
            SecurityGroup awsSecurityGroup = getSecurityGroupsIdUsingEC2Client(this.client, provisionedGroupIdentifier.getGroupId());
            assertNotNull(awsSecurityGroup);
            // Validate rules are correctly created as requested
            IpPermission awsIngressRule = awsSecurityGroup.getIpPermissions().get(0);
            IpPermission awsEgressRule = awsSecurityGroup.getIpPermissionsEgress().get(1);
            assertNotNull(awsIngressRule);
            assertNotNull(awsEgressRule);
            assertEquals("Error in created ingress rule", awsIngressRule.getIpProtocol(), currentSGState.ingress.get(0).protocol);
            assertEquals("Error in created ingress rule", awsIngressRule.getIpv4Ranges().get(0).getCidrIp(), currentSGState.ingress.get(0).ipRangeCidr);
            assertEquals("Error in created egress rule", awsEgressRule.getIpProtocol(), currentSGState.egress.get(0).protocol);
            assertEquals("Error in created egress rule", awsEgressRule.getIpv4Ranges().get(0).getCidrIp(), currentSGState.egress.get(0).ipRangeCidr);
        }
    }
}