diff --git a/src/__tests__/__snapshots__/_limited-internet-access.test.ts.snap b/src/__tests__/__snapshots__/_limited-internet-access.test.ts.snap index 149844468..adb7ff45c 100644 --- a/src/__tests__/__snapshots__/_limited-internet-access.test.ts.snap +++ b/src/__tests__/__snapshots__/_limited-internet-access.test.ts.snap @@ -808,81 +808,81 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` }, "Type": "AWS::EC2::SecurityGroupEgress", }, - "githubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2": { + "githubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74": { "Properties": { "AddressFamily": "IPv4", "Entries": [ { - "Cidr": "140.82.112.0/20", + "Cidr": "4.208.26.200/32", }, { - "Cidr": "143.55.64.0/20", + "Cidr": "4.225.11.201/32", }, { - "Cidr": "172.182.252.137/32", + "Cidr": "4.228.31.149/32", }, { - "Cidr": "185.199.108.0/22", + "Cidr": "4.237.22.34/32", }, { - "Cidr": "192.30.252.0/22", + "Cidr": "4.249.131.166/32", }, { - "Cidr": "20.175.192.149/32", + "Cidr": "20.26.156.210/32", }, { - "Cidr": "20.199.39.228/32", + "Cidr": "20.27.177.116/32", }, { - "Cidr": "20.200.245.245/32", + "Cidr": "20.29.134.17/32", }, { - "Cidr": "20.205.243.168/32", + "Cidr": "20.87.245.6/32", }, { - "Cidr": "20.207.73.85/32", + "Cidr": "20.175.192.149/32", }, { - "Cidr": "20.217.135.0/32", + "Cidr": "20.199.39.228/32", }, { - "Cidr": "20.233.83.146/32", + "Cidr": "20.200.245.245/32", }, { - "Cidr": "20.250.119.72/32", + "Cidr": "20.205.243.168/32", }, { - "Cidr": "20.26.156.210/32", + "Cidr": "20.207.73.85/32", }, { - "Cidr": "20.27.177.116/32", + "Cidr": "20.217.135.0/32", }, { - "Cidr": "20.29.134.17/32", + "Cidr": "20.233.83.146/32", }, { - "Cidr": "20.87.245.6/32", + "Cidr": "20.250.119.72/32", }, { - "Cidr": "4.208.26.200/32", + "Cidr": "48.202.248.39/32", }, { - "Cidr": "4.225.11.201/32", + "Cidr": "48.204.201.2/32", }, { - "Cidr": "4.228.31.149/32", + "Cidr": "140.82.112.0/20", }, { - "Cidr": "4.237.22.34/32", + "Cidr": "143.55.64.0/20", }, { - "Cidr": "4.249.131.166/32", + "Cidr": "172.182.252.137/32", }, { - "Cidr": "48.202.248.39/32", + "Cidr": "185.199.108.0/22", }, { - "Cidr": "48.204.201.2/32", + "Cidr": "192.30.252.0/22", }, ], "MaxEntries": 24, @@ -890,7 +890,7 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` }, "Type": "AWS::EC2::PrefixList", }, - "githubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f206355869": { + "githubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74EE137166": { "Properties": { "GroupDescription": "TestStack/github.api-IPv4", "Tags": [ @@ -905,19 +905,19 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` }, "Type": "AWS::EC2::SecurityGroup", }, - "githubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2toTestStackgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f24439891566C": { + "githubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74toTestStackgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74443F4D2A5CA": { "Properties": { "Description": "to github.api (IPv4)", "DestinationPrefixListId": { "Fn::GetAtt": [ - "githubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2", + "githubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74", "PrefixListId", ], }, "FromPort": 443, "GroupId": { "Fn::GetAtt": [ - "githubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f206355869", + "githubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74EE137166", "GroupId", ], }, @@ -926,123 +926,60 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` }, "Type": "AWS::EC2::SecurityGroupEgress", }, - "githubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0": { + "githubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245": { "Properties": { "AddressFamily": "IPv4", "Entries": [ { - "Cidr": "135.235.149.144/28", - }, - { - "Cidr": "140.82.112.0/20", - }, - { - "Cidr": "143.55.64.0/20", - }, - { - "Cidr": "172.130.153.16/28", - }, - { - "Cidr": "172.130.201.80/28", - }, - { - "Cidr": "172.182.252.130/32", - }, - { - "Cidr": "172.182.252.133/32", - }, - { - "Cidr": "172.182.252.135/32", - }, - { - "Cidr": "172.194.155.208/28", - }, - { - "Cidr": "172.194.218.192/28", - }, - { - "Cidr": "185.199.108.0/22", - }, - { - "Cidr": "192.30.252.0/22", - }, - { - "Cidr": "20.169.109.160/28", - }, - { - "Cidr": "20.172.24.160/28", - }, - { - "Cidr": "20.175.192.146/32", - }, - { - "Cidr": "20.175.192.147/32", - }, - { - "Cidr": "20.199.39.227/32", - }, - { - "Cidr": "20.199.39.232/32", - }, - { - "Cidr": "20.200.245.244/32", - }, - { - "Cidr": "20.200.245.247/32", - }, - { - "Cidr": "20.200.245.248/32", - }, - { - "Cidr": "20.205.243.160/32", + "Cidr": "4.149.173.80/28", }, { - "Cidr": "20.205.243.161/32", + "Cidr": "4.159.108.160/28", }, { - "Cidr": "20.205.243.166/32", + "Cidr": "4.159.197.192/28", }, { - "Cidr": "20.207.73.81/32", + "Cidr": "4.186.157.192/28", }, { - "Cidr": "20.207.73.82/32", + "Cidr": "4.187.247.160/28", }, { - "Cidr": "20.207.73.83/32", + "Cidr": "4.195.217.80/28", }, { - "Cidr": "20.217.135.1/32", + "Cidr": "4.196.32.112/28", }, { - "Cidr": "20.217.135.4/32", + "Cidr": "4.208.26.193/32", }, { - "Cidr": "20.217.135.5/32", + "Cidr": "4.208.26.196/30", }, { - "Cidr": "20.233.83.145/32", + "Cidr": "4.225.11.192/28", }, { - "Cidr": "20.233.83.148/32", + "Cidr": "4.225.187.240/28", }, { - "Cidr": "20.233.83.149/32", + "Cidr": "4.228.31.144/31", }, { - "Cidr": "20.250.119.67/32", + "Cidr": "4.228.31.150/32", }, { - "Cidr": "20.250.119.68/32", + "Cidr": "4.234.31.32/28", }, { - "Cidr": "20.26.156.213/32", + "Cidr": "4.236.95.112/28", }, { - "Cidr": "20.26.156.214/32", + "Cidr": "4.237.22.32/28", }, { - "Cidr": "20.26.156.215/32", + "Cidr": "4.249.131.160/29", }, { "Cidr": "20.26.58.32/28", @@ -1051,153 +988,135 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` "Cidr": "20.26.68.64/28", }, { - "Cidr": "20.27.163.208/28", + "Cidr": "20.26.156.212/30", }, { - "Cidr": "20.27.177.113/32", + "Cidr": "20.27.163.208/28", }, { - "Cidr": "20.27.177.118/32", + "Cidr": "20.27.177.113/32", }, { - "Cidr": "20.27.177.119/32", + "Cidr": "20.27.177.118/31", }, { "Cidr": "20.29.134.19/32", }, { - "Cidr": "20.29.134.22/32", + "Cidr": "20.29.134.22/31", }, { - "Cidr": "20.29.134.23/32", - }, - { - "Cidr": "20.87.245.0/32", - }, - { - "Cidr": "20.87.245.2/32", + "Cidr": "20.87.245.0/30", }, { "Cidr": "20.87.245.4/32", }, { - "Cidr": "4.149.173.80/28", - }, - { - "Cidr": "4.159.108.160/28", - }, - { - "Cidr": "4.159.197.192/28", - }, - { - "Cidr": "4.186.157.192/28", - }, - { - "Cidr": "4.187.247.160/28", + "Cidr": "20.169.109.160/28", }, { - "Cidr": "4.195.217.80/28", + "Cidr": "20.172.24.160/28", }, { - "Cidr": "4.196.32.112/28", + "Cidr": "20.175.192.146/31", }, { - "Cidr": "4.208.26.193/32", + "Cidr": "20.199.39.227/32", }, { - "Cidr": "4.208.26.197/32", + "Cidr": "20.199.39.232/32", }, { - "Cidr": "4.208.26.198/32", + "Cidr": "20.200.245.240/28", }, { - "Cidr": "4.225.11.194/32", + "Cidr": "20.205.243.160/31", }, { - "Cidr": "4.225.11.199/32", + "Cidr": "20.205.243.166/32", }, { - "Cidr": "4.225.11.200/32", + "Cidr": "20.207.73.80/30", }, { - "Cidr": "4.225.187.240/28", + "Cidr": "20.217.135.1/32", }, { - "Cidr": "4.228.31.144/32", + "Cidr": "20.217.135.4/31", }, { - "Cidr": "4.228.31.145/32", + "Cidr": "20.233.83.145/32", }, { - "Cidr": "4.228.31.150/32", + "Cidr": "20.233.83.148/31", }, { - "Cidr": "4.234.31.32/28", + "Cidr": "20.250.119.64/29", }, { - "Cidr": "4.236.95.112/28", + "Cidr": "40.121.125.32/28", }, { - "Cidr": "4.237.22.36/32", + "Cidr": "40.121.125.128/25", }, { - "Cidr": "4.237.22.38/32", + "Cidr": "48.200.82.112/28", }, { - "Cidr": "4.237.22.40/32", + "Cidr": "48.202.10.80/28", }, { - "Cidr": "4.249.131.163/32", + "Cidr": "48.202.248.38/32", }, { - "Cidr": "4.249.131.164/32", + "Cidr": "48.202.248.40/32", }, { - "Cidr": "40.121.125.128/28", + "Cidr": "48.204.201.4/30", }, { - "Cidr": "40.121.125.144/28", + "Cidr": "135.235.149.144/28", }, { - "Cidr": "40.121.125.160/28", + "Cidr": "140.82.112.0/20", }, { - "Cidr": "40.121.125.176/28", + "Cidr": "143.55.64.0/20", }, { - "Cidr": "40.121.125.192/28", + "Cidr": "172.130.153.16/28", }, { - "Cidr": "40.121.125.208/28", + "Cidr": "172.130.201.80/28", }, { - "Cidr": "40.121.125.32/28", + "Cidr": "172.182.252.130/32", }, { - "Cidr": "48.200.82.112/28", + "Cidr": "172.182.252.133/32", }, { - "Cidr": "48.202.10.80/28", + "Cidr": "172.182.252.135/32", }, { - "Cidr": "48.202.248.38/32", + "Cidr": "172.194.155.208/28", }, { - "Cidr": "48.202.248.40/32", + "Cidr": "172.194.218.192/28", }, { - "Cidr": "48.204.201.5/32", + "Cidr": "185.199.108.0/22", }, { - "Cidr": "48.204.201.6/32", + "Cidr": "192.30.252.0/22", }, ], - "MaxEntries": 87, + "MaxEntries": 60, "PrefixListName": "github.git.IPv4", }, "Type": "AWS::EC2::PrefixList", }, - "githubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0853EB450": { + "githubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245747FDF27": { "Properties": { "GroupDescription": "TestStack/github.git-IPv4", "Tags": [ @@ -1212,19 +1131,19 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` }, "Type": "AWS::EC2::SecurityGroup", }, - "githubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0toTestStackgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0443B6E48BBE": { + "githubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245toTestStackgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce2454438F414957": { "Properties": { "Description": "to github.git (IPv4)", "DestinationPrefixListId": { "Fn::GetAtt": [ - "githubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0", + "githubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245", "PrefixListId", ], }, "FromPort": 443, "GroupId": { "Fn::GetAtt": [ - "githubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0853EB450", + "githubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245747FDF27", "GroupId", ], }, @@ -1233,87 +1152,72 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` }, "Type": "AWS::EC2::SecurityGroupEgress", }, - "githubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4": { + "githubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33": { "Properties": { "AddressFamily": "IPv4", "Entries": [ { - "Cidr": "135.235.149.144/28", - }, - { - "Cidr": "140.82.112.0/20", - }, - { - "Cidr": "143.55.64.0/20", - }, - { - "Cidr": "172.130.153.16/28", - }, - { - "Cidr": "172.130.201.80/28", - }, - { - "Cidr": "172.182.252.130/32", + "Cidr": "4.149.173.80/28", }, { - "Cidr": "172.182.252.133/32", + "Cidr": "4.159.108.160/28", }, { - "Cidr": "172.194.155.208/28", + "Cidr": "4.159.197.192/28", }, { - "Cidr": "172.194.218.192/28", + "Cidr": "4.186.157.192/28", }, { - "Cidr": "185.199.108.0/22", + "Cidr": "4.187.247.160/28", }, { - "Cidr": "192.30.252.0/22", + "Cidr": "4.195.217.80/28", }, { - "Cidr": "20.169.109.160/28", + "Cidr": "4.196.32.112/28", }, { - "Cidr": "20.172.24.160/28", + "Cidr": "4.208.26.193/32", }, { - "Cidr": "20.175.192.147/32", + "Cidr": "4.208.26.197/32", }, { - "Cidr": "20.199.39.232/32", + "Cidr": "4.225.11.194/32", }, { - "Cidr": "20.200.245.244/32", + "Cidr": "4.225.11.199/32", }, { - "Cidr": "20.200.245.247/32", + "Cidr": "4.225.187.240/28", }, { - "Cidr": "20.205.243.161/32", + "Cidr": "4.228.31.144/32", }, { - "Cidr": "20.205.243.166/32", + "Cidr": "4.228.31.150/32", }, { - "Cidr": "20.207.73.81/32", + "Cidr": "4.234.31.32/28", }, { - "Cidr": "20.207.73.82/32", + "Cidr": "4.236.95.112/28", }, { - "Cidr": "20.217.135.1/32", + "Cidr": "4.237.22.36/32", }, { - "Cidr": "20.217.135.5/32", + "Cidr": "4.237.22.38/32", }, { - "Cidr": "20.233.83.145/32", + "Cidr": "4.249.131.164/32", }, { - "Cidr": "20.233.83.148/32", + "Cidr": "20.26.58.32/28", }, { - "Cidr": "20.250.119.67/32", + "Cidr": "20.26.68.64/28", }, { "Cidr": "20.26.156.213/32", @@ -1321,12 +1225,6 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` { "Cidr": "20.26.156.215/32", }, - { - "Cidr": "20.26.58.32/28", - }, - { - "Cidr": "20.26.68.64/28", - }, { "Cidr": "20.27.163.208/28", }, @@ -1337,10 +1235,7 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` "Cidr": "20.27.177.119/32", }, { - "Cidr": "20.29.134.22/32", - }, - { - "Cidr": "20.29.134.23/32", + "Cidr": "20.29.134.22/31", }, { "Cidr": "20.87.245.0/32", @@ -1349,102 +1244,105 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` "Cidr": "20.87.245.2/32", }, { - "Cidr": "4.149.173.80/28", + "Cidr": "20.169.109.160/28", }, { - "Cidr": "4.159.108.160/28", + "Cidr": "20.172.24.160/28", }, { - "Cidr": "4.159.197.192/28", + "Cidr": "20.175.192.147/32", }, { - "Cidr": "4.186.157.192/28", + "Cidr": "20.199.39.232/32", }, { - "Cidr": "4.187.247.160/28", + "Cidr": "20.200.245.244/32", }, { - "Cidr": "4.195.217.80/28", + "Cidr": "20.200.245.247/32", }, { - "Cidr": "4.196.32.112/28", + "Cidr": "20.205.243.161/32", }, { - "Cidr": "4.208.26.193/32", + "Cidr": "20.205.243.166/32", }, { - "Cidr": "4.208.26.197/32", + "Cidr": "20.207.73.80/30", }, { - "Cidr": "4.225.11.194/32", + "Cidr": "20.217.135.1/32", }, { - "Cidr": "4.225.11.199/32", + "Cidr": "20.217.135.5/32", }, { - "Cidr": "4.225.187.240/28", + "Cidr": "20.233.83.145/32", }, { - "Cidr": "4.228.31.144/32", + "Cidr": "20.233.83.148/32", }, { - "Cidr": "4.228.31.150/32", + "Cidr": "20.250.119.67/32", }, { - "Cidr": "4.234.31.32/28", + "Cidr": "40.121.125.32/28", }, { - "Cidr": "4.236.95.112/28", + "Cidr": "40.121.125.128/25", }, { - "Cidr": "4.237.22.36/32", + "Cidr": "48.200.82.112/28", }, { - "Cidr": "4.237.22.38/32", + "Cidr": "48.202.10.80/28", }, { - "Cidr": "4.249.131.164/32", + "Cidr": "48.202.248.40/32", }, { - "Cidr": "40.121.125.128/28", + "Cidr": "48.204.201.5/32", }, { - "Cidr": "40.121.125.144/28", + "Cidr": "135.235.149.144/28", }, { - "Cidr": "40.121.125.160/28", + "Cidr": "140.82.112.0/20", }, { - "Cidr": "40.121.125.176/28", + "Cidr": "143.55.64.0/20", }, { - "Cidr": "40.121.125.192/28", + "Cidr": "172.130.153.16/28", }, { - "Cidr": "40.121.125.208/28", + "Cidr": "172.130.201.80/28", }, { - "Cidr": "40.121.125.32/28", + "Cidr": "172.182.252.130/32", }, { - "Cidr": "48.200.82.112/28", + "Cidr": "172.182.252.133/32", }, { - "Cidr": "48.202.10.80/28", + "Cidr": "172.194.155.208/28", }, { - "Cidr": "48.202.248.40/32", + "Cidr": "172.194.218.192/28", }, { - "Cidr": "48.204.201.5/32", + "Cidr": "185.199.108.0/22", + }, + { + "Cidr": "192.30.252.0/22", }, ], - "MaxEntries": 67, + "MaxEntries": 60, "PrefixListName": "github.web.IPv4", }, "Type": "AWS::EC2::PrefixList", }, - "githubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4833B85D9": { + "githubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33C57E9BD9": { "Properties": { "GroupDescription": "TestStack/github.web-IPv4", "Tags": [ @@ -1459,19 +1357,19 @@ exports[`createRestrictedSecurityGroups creates the correct resources 1`] = ` }, "Type": "AWS::EC2::SecurityGroup", }, - "githubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4toTestStackgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d44434A69E573": { + "githubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33toTestStackgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d3344387CA29F0": { "Properties": { "Description": "to github.web (IPv4)", "DestinationPrefixListId": { "Fn::GetAtt": [ - "githubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4", + "githubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33", "PrefixListId", ], }, "FromPort": 443, "GroupId": { "Fn::GetAtt": [ - "githubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4833B85D9", + "githubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33C57E9BD9", "GroupId", ], }, diff --git a/src/__tests__/__snapshots__/construct-hub.test.ts.snap b/src/__tests__/__snapshots__/construct-hub.test.ts.snap index cd29df588..d3caad424 100644 --- a/src/__tests__/__snapshots__/construct-hub.test.ts.snap +++ b/src/__tests__/__snapshots__/construct-hub.test.ts.snap @@ -64036,21 +64036,21 @@ Direct link to function: /lambda/home#/functions/", "","", { "Fn::GetAtt": [ - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2F468B09A", + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74329AE083", "GroupId", ], }, "","", { "Fn::GetAtt": [ - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b093ED4D01", + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245BD50E36C", "GroupId", ], }, "","", { "Fn::GetAtt": [ - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4E47AB4CB", + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33D3BD442F", "GroupId", ], }, @@ -71409,19 +71409,19 @@ Runbook: https://github.com/cdklabs/construct-hub/blob/main/docs/operator-runboo }, { "Fn::GetAtt": [ - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2F468B09A", + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74329AE083", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b093ED4D01", + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245BD50E36C", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4E47AB4CB", + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33D3BD442F", "GroupId", ], }, @@ -71496,19 +71496,19 @@ Runbook: https://github.com/cdklabs/construct-hub/blob/main/docs/operator-runboo }, { "Fn::GetAtt": [ - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2F468B09A", + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74329AE083", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b093ED4D01", + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245BD50E36C", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4E47AB4CB", + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33D3BD442F", "GroupId", ], }, @@ -71606,19 +71606,19 @@ Runbook: https://github.com/cdklabs/construct-hub/blob/main/docs/operator-runboo }, { "Fn::GetAtt": [ - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2F468B09A", + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74329AE083", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b093ED4D01", + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245BD50E36C", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4E47AB4CB", + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33D3BD442F", "GroupId", ], }, @@ -74135,19 +74135,19 @@ Runbook: https://github.com/cdklabs/construct-hub/blob/main/docs/operator-runboo }, { "Fn::GetAtt": [ - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2F468B09A", + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74329AE083", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b093ED4D01", + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245BD50E36C", "GroupId", ], }, { "Fn::GetAtt": [ - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4E47AB4CB", + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33D3BD442F", "GroupId", ], }, @@ -75167,81 +75167,124 @@ function handler(event) { }, "Type": "AWS::EC2::SecurityGroupEgress", }, - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f240FE4763": { + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74329AE083": { + "Properties": { + "GroupDescription": "Test/ConstructHub/github.api-IPv4", + "SecurityGroupIngress": [ + { + "CidrIp": { + "Fn::GetAtt": [ + "ConstructHubVPC16ECCEA2", + "CidrBlock", + ], + }, + "Description": { + "Fn::Join": [ + "", + [ + "from ", + { + "Fn::GetAtt": [ + "ConstructHubVPC16ECCEA2", + "CidrBlock", + ], + }, + ":443", + ], + ], + }, + "FromPort": 443, + "IpProtocol": "tcp", + "ToPort": 443, + }, + ], + "Tags": [ + { + "Key": "Name", + "Value": "github.api.IPv4", + }, + ], + "VpcId": { + "Ref": "ConstructHubVPC16ECCEA2", + }, + }, + "Type": "AWS::EC2::SecurityGroup", + }, + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae743DFCC6E8": { "Properties": { "AddressFamily": "IPv4", "Entries": [ { - "Cidr": "140.82.112.0/20", + "Cidr": "4.208.26.200/32", }, { - "Cidr": "143.55.64.0/20", + "Cidr": "4.225.11.201/32", }, { - "Cidr": "172.182.252.137/32", + "Cidr": "4.228.31.149/32", }, { - "Cidr": "185.199.108.0/22", + "Cidr": "4.237.22.34/32", }, { - "Cidr": "192.30.252.0/22", + "Cidr": "4.249.131.166/32", }, { - "Cidr": "20.175.192.149/32", + "Cidr": "20.26.156.210/32", }, { - "Cidr": "20.199.39.228/32", + "Cidr": "20.27.177.116/32", }, { - "Cidr": "20.200.245.245/32", + "Cidr": "20.29.134.17/32", }, { - "Cidr": "20.205.243.168/32", + "Cidr": "20.87.245.6/32", }, { - "Cidr": "20.207.73.85/32", + "Cidr": "20.175.192.149/32", }, { - "Cidr": "20.217.135.0/32", + "Cidr": "20.199.39.228/32", }, { - "Cidr": "20.233.83.146/32", + "Cidr": "20.200.245.245/32", }, { - "Cidr": "20.250.119.72/32", + "Cidr": "20.205.243.168/32", }, { - "Cidr": "20.26.156.210/32", + "Cidr": "20.207.73.85/32", }, { - "Cidr": "20.27.177.116/32", + "Cidr": "20.217.135.0/32", }, { - "Cidr": "20.29.134.17/32", + "Cidr": "20.233.83.146/32", }, { - "Cidr": "20.87.245.6/32", + "Cidr": "20.250.119.72/32", }, { - "Cidr": "4.208.26.200/32", + "Cidr": "48.202.248.39/32", }, { - "Cidr": "4.225.11.201/32", + "Cidr": "48.204.201.2/32", }, { - "Cidr": "4.228.31.149/32", + "Cidr": "140.82.112.0/20", }, { - "Cidr": "4.237.22.34/32", + "Cidr": "143.55.64.0/20", }, { - "Cidr": "4.249.131.166/32", + "Cidr": "172.182.252.137/32", }, { - "Cidr": "48.202.248.39/32", + "Cidr": "185.199.108.0/22", }, { - "Cidr": "48.204.201.2/32", + "Cidr": "192.30.252.0/22", }, ], "MaxEntries": 24, @@ -75249,9 +75292,30 @@ function handler(event) { }, "Type": "AWS::EC2::PrefixList", }, - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2F468B09A": { + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74toTestConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74443810A0EDF": { "Properties": { - "GroupDescription": "Test/ConstructHub/github.api-IPv4", + "Description": "to github.api (IPv4)", + "DestinationPrefixListId": { + "Fn::GetAtt": [ + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae743DFCC6E8", + "PrefixListId", + ], + }, + "FromPort": 443, + "GroupId": { + "Fn::GetAtt": [ + "ConstructHubgithubapiIPv444560ef5391375b8ad4f80a94882df684d5dae74329AE083", + "GroupId", + ], + }, + "IpProtocol": "tcp", + "ToPort": 443, + }, + "Type": "AWS::EC2::SecurityGroupEgress", + }, + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245BD50E36C": { + "Properties": { + "GroupDescription": "Test/ConstructHub/github.git-IPv4", "SecurityGroupIngress": [ { "CidrIp": { @@ -75283,7 +75347,7 @@ function handler(event) { "Tags": [ { "Key": "Name", - "Value": "github.api.IPv4", + "Value": "github.git.IPv4", }, ], "VpcId": { @@ -75292,181 +75356,221 @@ function handler(event) { }, "Type": "AWS::EC2::SecurityGroup", }, - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2toTestConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f244307A8356E": { - "Properties": { - "Description": "to github.api (IPv4)", - "DestinationPrefixListId": { - "Fn::GetAtt": [ - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f240FE4763", - "PrefixListId", - ], - }, - "FromPort": 443, - "GroupId": { - "Fn::GetAtt": [ - "ConstructHubgithubapiIPv4921031eda860265894b41fbf766dd5e1dee7a3f2F468B09A", - "GroupId", - ], - }, - "IpProtocol": "tcp", - "ToPort": 443, - }, - "Type": "AWS::EC2::SecurityGroupEgress", - }, - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b085FBEFE9": { + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245CD6EA928": { "Properties": { "AddressFamily": "IPv4", "Entries": [ { - "Cidr": "135.235.149.144/28", + "Cidr": "4.149.173.80/28", }, { - "Cidr": "140.82.112.0/20", + "Cidr": "4.159.108.160/28", }, { - "Cidr": "143.55.64.0/20", + "Cidr": "4.159.197.192/28", }, { - "Cidr": "172.130.153.16/28", + "Cidr": "4.186.157.192/28", }, { - "Cidr": "172.130.201.80/28", + "Cidr": "4.187.247.160/28", }, { - "Cidr": "172.182.252.130/32", + "Cidr": "4.195.217.80/28", }, { - "Cidr": "172.182.252.133/32", + "Cidr": "4.196.32.112/28", }, { - "Cidr": "172.182.252.135/32", + "Cidr": "4.208.26.193/32", }, { - "Cidr": "172.194.155.208/28", + "Cidr": "4.208.26.196/30", }, { - "Cidr": "172.194.218.192/28", + "Cidr": "4.225.11.192/28", }, { - "Cidr": "185.199.108.0/22", + "Cidr": "4.225.187.240/28", }, { - "Cidr": "192.30.252.0/22", + "Cidr": "4.228.31.144/31", }, { - "Cidr": "20.169.109.160/28", + "Cidr": "4.228.31.150/32", }, { - "Cidr": "20.172.24.160/28", + "Cidr": "4.234.31.32/28", }, { - "Cidr": "20.175.192.146/32", + "Cidr": "4.236.95.112/28", }, { - "Cidr": "20.175.192.147/32", + "Cidr": "4.237.22.32/28", }, { - "Cidr": "20.199.39.227/32", + "Cidr": "4.249.131.160/29", }, { - "Cidr": "20.199.39.232/32", + "Cidr": "20.26.58.32/28", }, { - "Cidr": "20.200.245.244/32", + "Cidr": "20.26.68.64/28", }, { - "Cidr": "20.200.245.247/32", + "Cidr": "20.26.156.212/30", }, { - "Cidr": "20.200.245.248/32", + "Cidr": "20.27.163.208/28", }, { - "Cidr": "20.205.243.160/32", + "Cidr": "20.27.177.113/32", }, { - "Cidr": "20.205.243.161/32", + "Cidr": "20.27.177.118/31", }, { - "Cidr": "20.205.243.166/32", + "Cidr": "20.29.134.19/32", }, { - "Cidr": "20.207.73.81/32", + "Cidr": "20.29.134.22/31", }, { - "Cidr": "20.207.73.82/32", + "Cidr": "20.87.245.0/30", }, { - "Cidr": "20.207.73.83/32", + "Cidr": "20.87.245.4/32", }, { - "Cidr": "20.217.135.1/32", + "Cidr": "20.169.109.160/28", + }, + { + "Cidr": "20.172.24.160/28", }, { - "Cidr": "20.217.135.4/32", + "Cidr": "20.175.192.146/31", }, { - "Cidr": "20.217.135.5/32", + "Cidr": "20.199.39.227/32", + }, + { + "Cidr": "20.199.39.232/32", + }, + { + "Cidr": "20.200.245.240/28", + }, + { + "Cidr": "20.205.243.160/31", + }, + { + "Cidr": "20.205.243.166/32", + }, + { + "Cidr": "20.207.73.80/30", + }, + { + "Cidr": "20.217.135.1/32", + }, + { + "Cidr": "20.217.135.4/31", }, { "Cidr": "20.233.83.145/32", }, { - "Cidr": "20.233.83.148/32", + "Cidr": "20.233.83.148/31", }, { - "Cidr": "20.233.83.149/32", + "Cidr": "20.250.119.64/29", }, { - "Cidr": "20.250.119.67/32", + "Cidr": "40.121.125.32/28", }, { - "Cidr": "20.250.119.68/32", + "Cidr": "40.121.125.128/25", }, { - "Cidr": "20.26.156.213/32", + "Cidr": "48.200.82.112/28", }, { - "Cidr": "20.26.156.214/32", + "Cidr": "48.202.10.80/28", }, { - "Cidr": "20.26.156.215/32", + "Cidr": "48.202.248.38/32", }, { - "Cidr": "20.26.58.32/28", + "Cidr": "48.202.248.40/32", }, { - "Cidr": "20.26.68.64/28", + "Cidr": "48.204.201.4/30", }, { - "Cidr": "20.27.163.208/28", + "Cidr": "135.235.149.144/28", }, { - "Cidr": "20.27.177.113/32", + "Cidr": "140.82.112.0/20", }, { - "Cidr": "20.27.177.118/32", + "Cidr": "143.55.64.0/20", }, { - "Cidr": "20.27.177.119/32", + "Cidr": "172.130.153.16/28", }, { - "Cidr": "20.29.134.19/32", + "Cidr": "172.130.201.80/28", }, { - "Cidr": "20.29.134.22/32", + "Cidr": "172.182.252.130/32", }, { - "Cidr": "20.29.134.23/32", + "Cidr": "172.182.252.133/32", }, { - "Cidr": "20.87.245.0/32", + "Cidr": "172.182.252.135/32", }, { - "Cidr": "20.87.245.2/32", + "Cidr": "172.194.155.208/28", }, { - "Cidr": "20.87.245.4/32", + "Cidr": "172.194.218.192/28", + }, + { + "Cidr": "185.199.108.0/22", }, + { + "Cidr": "192.30.252.0/22", + }, + ], + "MaxEntries": 60, + "PrefixListName": "github.git.IPv4", + }, + "Type": "AWS::EC2::PrefixList", + }, + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245toTestConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce24544349F38BAB": { + "Properties": { + "Description": "to github.git (IPv4)", + "DestinationPrefixListId": { + "Fn::GetAtt": [ + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245CD6EA928", + "PrefixListId", + ], + }, + "FromPort": 443, + "GroupId": { + "Fn::GetAtt": [ + "ConstructHubgithubgitIPv4cc7b59daa18c1b3f2d6bddbb8f3e9572f2bce245BD50E36C", + "GroupId", + ], + }, + "IpProtocol": "tcp", + "ToPort": 443, + }, + "Type": "AWS::EC2::SecurityGroupEgress", + }, + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d335B724C17": { + "Properties": { + "AddressFamily": "IPv4", + "Entries": [ { "Cidr": "4.149.173.80/28", }, @@ -75494,9 +75598,6 @@ function handler(event) { { "Cidr": "4.208.26.197/32", }, - { - "Cidr": "4.208.26.198/32", - }, { "Cidr": "4.225.11.194/32", }, @@ -75504,17 +75605,11 @@ function handler(event) { "Cidr": "4.225.11.199/32", }, { - "Cidr": "4.225.11.200/32", - }, - { - "Cidr": "4.225.187.240/28", + "Cidr": "4.225.187.240/28", }, { "Cidr": "4.228.31.144/32", }, - { - "Cidr": "4.228.31.145/32", - }, { "Cidr": "4.228.31.150/32", }, @@ -75530,203 +75625,38 @@ function handler(event) { { "Cidr": "4.237.22.38/32", }, - { - "Cidr": "4.237.22.40/32", - }, - { - "Cidr": "4.249.131.163/32", - }, { "Cidr": "4.249.131.164/32", }, { - "Cidr": "40.121.125.128/28", - }, - { - "Cidr": "40.121.125.144/28", - }, - { - "Cidr": "40.121.125.160/28", - }, - { - "Cidr": "40.121.125.176/28", - }, - { - "Cidr": "40.121.125.192/28", - }, - { - "Cidr": "40.121.125.208/28", - }, - { - "Cidr": "40.121.125.32/28", - }, - { - "Cidr": "48.200.82.112/28", - }, - { - "Cidr": "48.202.10.80/28", - }, - { - "Cidr": "48.202.248.38/32", - }, - { - "Cidr": "48.202.248.40/32", - }, - { - "Cidr": "48.204.201.5/32", - }, - { - "Cidr": "48.204.201.6/32", - }, - ], - "MaxEntries": 87, - "PrefixListName": "github.git.IPv4", - }, - "Type": "AWS::EC2::PrefixList", - }, - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b093ED4D01": { - "Properties": { - "GroupDescription": "Test/ConstructHub/github.git-IPv4", - "SecurityGroupIngress": [ - { - "CidrIp": { - "Fn::GetAtt": [ - "ConstructHubVPC16ECCEA2", - "CidrBlock", - ], - }, - "Description": { - "Fn::Join": [ - "", - [ - "from ", - { - "Fn::GetAtt": [ - "ConstructHubVPC16ECCEA2", - "CidrBlock", - ], - }, - ":443", - ], - ], - }, - "FromPort": 443, - "IpProtocol": "tcp", - "ToPort": 443, - }, - ], - "Tags": [ - { - "Key": "Name", - "Value": "github.git.IPv4", - }, - ], - "VpcId": { - "Ref": "ConstructHubVPC16ECCEA2", - }, - }, - "Type": "AWS::EC2::SecurityGroup", - }, - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0toTestConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b0443F0CEEA00": { - "Properties": { - "Description": "to github.git (IPv4)", - "DestinationPrefixListId": { - "Fn::GetAtt": [ - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b085FBEFE9", - "PrefixListId", - ], - }, - "FromPort": 443, - "GroupId": { - "Fn::GetAtt": [ - "ConstructHubgithubgitIPv4f49a64c15754b2bec33fe157d9c41f895929f3b093ED4D01", - "GroupId", - ], - }, - "IpProtocol": "tcp", - "ToPort": 443, - }, - "Type": "AWS::EC2::SecurityGroupEgress", - }, - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4E47AB4CB": { - "Properties": { - "GroupDescription": "Test/ConstructHub/github.web-IPv4", - "SecurityGroupIngress": [ - { - "CidrIp": { - "Fn::GetAtt": [ - "ConstructHubVPC16ECCEA2", - "CidrBlock", - ], - }, - "Description": { - "Fn::Join": [ - "", - [ - "from ", - { - "Fn::GetAtt": [ - "ConstructHubVPC16ECCEA2", - "CidrBlock", - ], - }, - ":443", - ], - ], - }, - "FromPort": 443, - "IpProtocol": "tcp", - "ToPort": 443, - }, - ], - "Tags": [ - { - "Key": "Name", - "Value": "github.web.IPv4", - }, - ], - "VpcId": { - "Ref": "ConstructHubVPC16ECCEA2", - }, - }, - "Type": "AWS::EC2::SecurityGroup", - }, - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4F57C7EE2": { - "Properties": { - "AddressFamily": "IPv4", - "Entries": [ - { - "Cidr": "135.235.149.144/28", - }, - { - "Cidr": "140.82.112.0/20", + "Cidr": "20.26.58.32/28", }, { - "Cidr": "143.55.64.0/20", + "Cidr": "20.26.68.64/28", }, { - "Cidr": "172.130.153.16/28", + "Cidr": "20.26.156.213/32", }, { - "Cidr": "172.130.201.80/28", + "Cidr": "20.26.156.215/32", }, { - "Cidr": "172.182.252.130/32", + "Cidr": "20.27.163.208/28", }, { - "Cidr": "172.182.252.133/32", + "Cidr": "20.27.177.113/32", }, { - "Cidr": "172.194.155.208/28", + "Cidr": "20.27.177.119/32", }, { - "Cidr": "172.194.218.192/28", + "Cidr": "20.29.134.22/31", }, { - "Cidr": "185.199.108.0/22", + "Cidr": "20.87.245.0/32", }, { - "Cidr": "192.30.252.0/22", + "Cidr": "20.87.245.2/32", }, { "Cidr": "20.169.109.160/28", @@ -75753,10 +75683,7 @@ function handler(event) { "Cidr": "20.205.243.166/32", }, { - "Cidr": "20.207.73.81/32", - }, - { - "Cidr": "20.207.73.82/32", + "Cidr": "20.207.73.80/30", }, { "Cidr": "20.217.135.1/32", @@ -75774,147 +75701,118 @@ function handler(event) { "Cidr": "20.250.119.67/32", }, { - "Cidr": "20.26.156.213/32", - }, - { - "Cidr": "20.26.156.215/32", - }, - { - "Cidr": "20.26.58.32/28", - }, - { - "Cidr": "20.26.68.64/28", - }, - { - "Cidr": "20.27.163.208/28", - }, - { - "Cidr": "20.27.177.113/32", - }, - { - "Cidr": "20.27.177.119/32", - }, - { - "Cidr": "20.29.134.22/32", - }, - { - "Cidr": "20.29.134.23/32", - }, - { - "Cidr": "20.87.245.0/32", - }, - { - "Cidr": "20.87.245.2/32", - }, - { - "Cidr": "4.149.173.80/28", - }, - { - "Cidr": "4.159.108.160/28", - }, - { - "Cidr": "4.159.197.192/28", - }, - { - "Cidr": "4.186.157.192/28", - }, - { - "Cidr": "4.187.247.160/28", - }, - { - "Cidr": "4.195.217.80/28", - }, - { - "Cidr": "4.196.32.112/28", - }, - { - "Cidr": "4.208.26.193/32", - }, - { - "Cidr": "4.208.26.197/32", - }, - { - "Cidr": "4.225.11.194/32", - }, - { - "Cidr": "4.225.11.199/32", - }, - { - "Cidr": "4.225.187.240/28", + "Cidr": "40.121.125.32/28", }, { - "Cidr": "4.228.31.144/32", + "Cidr": "40.121.125.128/25", }, { - "Cidr": "4.228.31.150/32", + "Cidr": "48.200.82.112/28", }, { - "Cidr": "4.234.31.32/28", + "Cidr": "48.202.10.80/28", }, { - "Cidr": "4.236.95.112/28", + "Cidr": "48.202.248.40/32", }, { - "Cidr": "4.237.22.36/32", + "Cidr": "48.204.201.5/32", }, { - "Cidr": "4.237.22.38/32", + "Cidr": "135.235.149.144/28", }, { - "Cidr": "4.249.131.164/32", + "Cidr": "140.82.112.0/20", }, { - "Cidr": "40.121.125.128/28", + "Cidr": "143.55.64.0/20", }, { - "Cidr": "40.121.125.144/28", + "Cidr": "172.130.153.16/28", }, { - "Cidr": "40.121.125.160/28", + "Cidr": "172.130.201.80/28", }, { - "Cidr": "40.121.125.176/28", + "Cidr": "172.182.252.130/32", }, { - "Cidr": "40.121.125.192/28", + "Cidr": "172.182.252.133/32", }, { - "Cidr": "40.121.125.208/28", + "Cidr": "172.194.155.208/28", }, { - "Cidr": "40.121.125.32/28", + "Cidr": "172.194.218.192/28", }, { - "Cidr": "48.200.82.112/28", + "Cidr": "185.199.108.0/22", }, { - "Cidr": "48.202.10.80/28", + "Cidr": "192.30.252.0/22", }, + ], + "MaxEntries": 60, + "PrefixListName": "github.web.IPv4", + }, + "Type": "AWS::EC2::PrefixList", + }, + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33D3BD442F": { + "Properties": { + "GroupDescription": "Test/ConstructHub/github.web-IPv4", + "SecurityGroupIngress": [ { - "Cidr": "48.202.248.40/32", + "CidrIp": { + "Fn::GetAtt": [ + "ConstructHubVPC16ECCEA2", + "CidrBlock", + ], + }, + "Description": { + "Fn::Join": [ + "", + [ + "from ", + { + "Fn::GetAtt": [ + "ConstructHubVPC16ECCEA2", + "CidrBlock", + ], + }, + ":443", + ], + ], + }, + "FromPort": 443, + "IpProtocol": "tcp", + "ToPort": 443, }, + ], + "Tags": [ { - "Cidr": "48.204.201.5/32", + "Key": "Name", + "Value": "github.web.IPv4", }, ], - "MaxEntries": 67, - "PrefixListName": "github.web.IPv4", + "VpcId": { + "Ref": "ConstructHubVPC16ECCEA2", + }, }, - "Type": "AWS::EC2::PrefixList", + "Type": "AWS::EC2::SecurityGroup", }, - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4toTestConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4443EB9FC0F7": { + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33toTestConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d334434E6AA571": { "Properties": { "Description": "to github.web (IPv4)", "DestinationPrefixListId": { "Fn::GetAtt": [ - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4F57C7EE2", + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d335B724C17", "PrefixListId", ], }, "FromPort": 443, "GroupId": { "Fn::GetAtt": [ - "ConstructHubgithubwebIPv4975b2a8579eb896193338544ce992e6714a8f6d4E47AB4CB", + "ConstructHubgithubwebIPv4e372d70509effe54ca11882992d1eb073aa89d33D3BD442F", "GroupId", ], }, diff --git a/src/__tests__/util/cidr-manipulation.test.ts b/src/__tests__/util/cidr-manipulation.test.ts new file mode 100644 index 000000000..f1d6a3004 --- /dev/null +++ b/src/__tests__/util/cidr-manipulation.test.ts @@ -0,0 +1,52 @@ +import { mergeCidrs as mergeCidrBlocks } from '../../util/cidr-manipulation'; + +/** Adapter so test cases can be written with plain strings */ +function mergeCidrs(maxEntries: number, cidrs: string[]): string[] { + return mergeCidrBlocks( + maxEntries, + cidrs.map((cidr) => ({ cidr })) + ).map((b) => b.cidr); +} + +test('returns input normalized when already under the limit', () => { + expect(mergeCidrs(5, ['10.0.0.5/24', '192.168.1.1'])).toEqual([ + '10.0.0.0/24', + '192.168.1.1/32', + ]); +}); + +test('drops contained ranges and duplicates', () => { + expect(mergeCidrs(5, ['10.0.0.0/8', '10.1.2.0/24', '10.0.0.0/8'])).toEqual([ + '10.0.0.0/8', + ]); +}); + +test('merges adjacent ranges before distant ones', () => { + expect( + mergeCidrs(2, ['10.0.0.0/25', '10.0.0.128/25', '192.168.0.0/24']) + ).toEqual(['10.0.0.0/24', '192.168.0.0/24']); +}); + +test('merges smallest gap first', () => { + expect(mergeCidrs(2, ['1.0.0.0/24', '1.0.2.0/24', '1.0.100.0/24'])).toEqual([ + '1.0.0.0/22', + '1.0.100.0/24', + ]); +}); + +test('supernet swallows ranges before the merged pair', () => { + // merging 10.0.0.8/29 and 10.0.0.16/29 gives 10.0.0.0/27, which also covers 10.0.0.0/30 + expect( + mergeCidrs(2, ['10.0.0.0/30', '10.0.0.8/29', '10.0.0.16/29', '200.0.0.0/8']) + ).toEqual(['10.0.0.0/27', '200.0.0.0/8']); +}); + +test('can merge down to a single entry', () => { + expect(mergeCidrs(1, ['0.0.0.0/1', '255.0.0.0/8'])).toEqual(['0.0.0.0/0']); +}); + +test('rejects invalid input', () => { + expect(() => mergeCidrs(1, ['10.0.0.256/8'])).toThrow(/valid/); + expect(() => mergeCidrs(1, ['2001:db8::/32'])).toThrow(/valid/); + expect(() => mergeCidrs(0, ['10.0.0.0/8'])).toThrow(/maxEntries/); +}); diff --git a/src/_limited-internet-access.ts b/src/_limited-internet-access.ts index 901bf9e38..2e764edd9 100644 --- a/src/_limited-internet-access.ts +++ b/src/_limited-internet-access.ts @@ -14,6 +14,7 @@ import { } from 'aws-cdk-lib/aws-ec2'; import { Construct } from 'constructs'; import { S3PrefixList } from './s3'; +import { mergeCidrs } from './util/cidr-manipulation'; /** * Creates SecurityGroups where "sensitive" operations should be listed, @@ -55,12 +56,16 @@ export function createRestrictedSecurityGroups( } const [, namespace, ipLabel] = matches; - const entries = parsePrefixList(join(ALLOW_LIST_DIR, file)); + let entries = parsePrefixList(join(ALLOW_LIST_DIR, file)); if (entries.length === 0) { continue; } + // The list of IP ranges may grow large, and Security Groups can have at most 60 rules (every entry in a prefix + // list is treated as a separate rule by EC2). We merge CIDR blocks to stay under the limit. + entries = mergeCidrs(60, entries); + // We use a SHA-1 digest of the list of prefixes to be sure we create a // whole new prefix list whenever it changes, so we are never bothered by // the maxEntries being what it is. @@ -179,7 +184,7 @@ export function parsePrefixList(filePath: string): CidrBlock[] { ); } -interface CidrBlock { +export interface CidrBlock { readonly cidr: string; } diff --git a/src/util/cidr-manipulation.ts b/src/util/cidr-manipulation.ts new file mode 100644 index 000000000..e03317db6 --- /dev/null +++ b/src/util/cidr-manipulation.ts @@ -0,0 +1,98 @@ +/* eslint-disable no-bitwise */ +import { CidrBlock } from '../_limited-internet-access'; + +/** + * From the given list of CIDRs, keep on progressively merging the ranges with the smallest distances between them until there are at most `maxEntries` left. + * + * Overlapping ranges are considered to have 0 distance between them so will be merged first, followed by ranges with the smallest gaps between them, and so on. + */ +export function mergeCidrs( + maxEntries: number, + cidrs: CidrBlock[] +): CidrBlock[] { + if (maxEntries < 1 && cidrs.length > 0) { + throw new Error(`maxEntries must be at least 1, got ${maxEntries}`); + } + + // Sorted by start; ranges contained in an earlier range are dropped. CIDRs either nest or are disjoint, + // so after this the list is strictly increasing and non-overlapping. + let ranges = normalize(cidrs.map(parseCidr)); + + while (ranges.length > maxEntries) { + let best = 0; + for (let i = 1; i < ranges.length - 1; i++) { + if (gap(ranges[i], ranges[i + 1]) < gap(ranges[best], ranges[best + 1])) { + best = i; + } + } + const merged = supernet(ranges[best], ranges[best + 1]); + // The supernet may start before (and swallow) earlier ranges, so re-normalize everything + ranges = normalize([ + ...ranges.slice(0, best), + merged, + ...ranges.slice(best + 2), + ]); + } + + return ranges.map(formatCidr).map((cidr) => ({ cidr })); +} + +interface Range { + /** First address, as an unsigned 32-bit integer */ + readonly start: number; + /** Last address, as an unsigned 32-bit integer */ + readonly end: number; + readonly prefix: number; +} + +// shortcut: IPv4 only, add BigInt-based IPv6 support if a caller needs it. +function parseCidr(cidr: CidrBlock): Range { + const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})(?:\/(\d{1,2}))?$/.exec( + cidr.cidr.trim() + ); + const octets = m?.slice(1, 5).map(Number); + const prefix = m?.[5] !== undefined ? Number(m[5]) : 32; + if (!octets || octets.some((o) => o > 255) || prefix > 32) { + throw new Error(`Not a valid IPv4 CIDR: ${cidr.cidr}`); + } + const addr = octets.reduce((acc, o) => acc * 256 + o, 0); + return makeRange(addr, prefix); +} + +function makeRange(addr: number, prefix: number): Range { + const size = 2 ** (32 - prefix); + const start = Math.floor(addr / size) * size; // normalize host bits away + return { start, end: start + size - 1, prefix }; +} + +function formatCidr({ start, prefix }: Range): string { + return `${[24, 16, 8, 0] + .map((s) => (start >>> s) & 255) + .join('.')}/${prefix}`; +} + +function gap(a: Range, b: Range): number { + return Math.max(0, b.start - a.end - 1); +} + +/** Smallest CIDR covering both ranges */ +function supernet(a: Range, b: Range): Range { + const diff = (Math.min(a.start, b.start) ^ Math.max(a.end, b.end)) >>> 0; + return makeRange( + Math.min(a.start, b.start), + Math.min(Math.clz32(diff), a.prefix, b.prefix) + ); +} + +/** Sort by start (bigger range first on ties) and drop ranges contained in another one. */ +function normalize(ranges: Range[]): Range[] { + const result: Range[] = []; + for (const r of [...ranges].sort( + (a, b) => a.start - b.start || a.prefix - b.prefix + )) { + if (result.length === 0 || r.end > result[result.length - 1].end) { + result.push(r); + } + } + return result; +}