Repository navigation
feat(grafana-github): open an issue for world-open security group rules - #225
Merged
Merged
Conversation
An EventBridge rule in femiwiki/infra sends each successful AuthorizeSecurityGroupIngress and ModifySecurityGroupRules call, from Seoul and Tokyo. A call that names 0.0.0.0/0 or ::/0 anywhere in its request opens an issue naming only the region and the CloudTrail event id, since the repository is public. Refs femiwiki/femiwiki#514. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NJZJo9Makhv53tkLdfmGom
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by lens0021 · project thread
Before: when someone opened a security group inbound rule to
0.0.0.0/0or::/0, by Terraform or the console, nothing told anyone (femiwiki/femiwiki#514).After: grafana-github opens an issue in femiwiki/infra titled
World-open inbound rule (10/15 20:00 KST), with thealertlabel and@femiwiki/pager. The body names only the region and the CloudTrail event id, with a console link, since the repository is public. An operator closes it once the rule is checked.How: a new
aws.ec2branch in the handler, fed by EventBridge rules in femiwiki/infra (companion PR,aws/sg-alerts.tf) for successfulAuthorizeSecurityGroupIngressandModifySecurityGroupRulescalls. The function searches the wholerequestParametersfor either CIDR, because the two calls shape their requests differently, and skips an event id that already has an open issue, since EventBridge delivers at least once. AModifySecurityGroupRulescall that names0.0.0.0/0on an egress rule also opens an issue; that call is rare here.Refs femiwiki/femiwiki#514
Generated by Claude Code