Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Support ALB authentication using AWS Cognito #102

Merged
merged 5 commits into from
May 27, 2020
Merged

feat: Support ALB authentication using AWS Cognito #102

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c7097b7
Refactor support for cognito
May 27, 2020
2e21a51
update readme with cognito details
May 27, 2020
28e67e5
Merge pull request #2 from trussworks/mk-cognito-redo
May 27, 2020
e116d1c
fix openid name
May 27, 2020
4ad9abb
Update README based on feedback
May 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,11 +101,13 @@ Make sure that both private and public subnets were created in the same set of a
If all provided subnets are public (no NAT gateway) then `ecs_service_assign_public_ip` should be set to `true`.


### Secure Atlantis with ALB Built-in Authentication and Auth0
### Secure Atlantis with ALB Built-in Authentication

#### OpenID Connect (OIDC)

You can use service like [Auth0](https://www.auth0.com) to secure access to Atlantis and require authentication on ALB. To enable this, you need to create Auth0 application and provide correct arguments to Atlantis module. Make sure to update application hostname, client id and client secret:

```
```hcl
alb_authenticate_oidc = {
issuer = "https://youruser.eu.auth0.com/"
token_endpoint = "https://youruser.eu.auth0.com/oauth/token"
Expand All @@ -119,9 +121,26 @@ alb_authenticate_oidc = {

Read more in [this post](https://medium.com/@sandrinodm/securing-your-applications-with-aws-alb-built-in-authentication-and-auth0-310ad84c8595).

If you are using GitHub, you may allow it to trigger webhooks without authentication on ALB:

#### AWS Cognito

The AWS Cognito service allows you to define SAML providers (e.g., GSuite). The Atlantis ALB can then be configured to require SAML authentication. To enable this, specify the following arguments containing attributes for your Cognito configuration.

```hcl
alb_authenticate_cognito = {
user_pool_arn = "arn:aws:cognito-idp:us-west-2:1234567890:userpool/us-west-2_aBcDeFG"
cognito_user_pool_client_id = "clientid123"
cognito_user_pool_domain = "sso.your-corp.com"
}
```

Read more in [this post](https://medium.com/@alsmola/alb-authentication-with-g-suite-saml-using-cognito-858e35564dc8) and a helpful [SAML Cognito Terraform module](https://github.com/alloy-commons/alloy-open-source/tree/master/terraform-modules/gsuite-saml-cognito).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium.com is a paid service and not everyone can read that post. It would be great if you include relevant information into README of your module so that everything is in one place. And remove the link from this module to the blog post (unless you can find it available on free resource).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried cleaning up this section and pointed to the example usage for the gsuite-saml-cognito module. Let me know if you have other thoughts.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you pushed your changes? I don't see them.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sigh. Sorry about that. They should be pushed now.


#### Allow GitHub Webhooks Unauthenticated Access

If you are using one of the authentication methods above along with commercial GitHub, you'll need to allow unauthenticated access to GitHub's Webhook static IPs:
dynamike marked this conversation as resolved.
Show resolved Hide resolved

```hcl
allow_unauthenticated_access = true
allow_github_webhooks = true
```
Expand Down Expand Up @@ -156,6 +175,7 @@ No requirements.
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| acm\_certificate\_domain\_name | Route53 domain name to use for ACM certificate. Route53 zone for this domain should be created in advance. Specify if it is different from value in `route53_zone_name` | `string` | `""` | no |
| alb\_authenticate\_cognito | Map of AWS Cognito authentication parameters to protect ALB (eg, using SAML). See https://www.terraform.io/docs/providers/aws/r/lb_listener.html#authenticate-cognito-action | `any` | `{}` | no |
| alb\_authenticate\_oidc | Map of Authenticate OIDC parameters to protect ALB (eg, using Auth0). See https://www.terraform.io/docs/providers/aws/r/lb_listener.html#authenticate-oidc-action | `any` | `{}` | no |
| alb\_ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all ingress rules of the ALB. | `list(string)` | <pre>[<br> "0.0.0.0/0"<br>]</pre> | no |
| alb\_log\_bucket\_name | S3 bucket (externally created) for storing load balancer access logs. Required if alb\_logging\_enabled is true. | `string` | `""` | no |
Expand Down
18 changes: 11 additions & 7 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ locals {

secret_webhook_key = local.has_secrets ? var.atlantis_gitlab_user_token != "" ? "ATLANTIS_GITLAB_WEBHOOK_SECRET" : var.atlantis_github_user_token != "" ? "ATLANTIS_GH_WEBHOOK_SECRET" : "ATLANTIS_BITBUCKET_WEBHOOK_SECRET" : "unknown_secret_webhook_key"

# determine if the alb has authentication enabled, otherwise forward the traffic unauthenticated
alb_authenication_method = length(keys(var.alb_authenticate_oidc)) > 0 ? "authenticate-oidc" : length(keys(var.alb_authenticate_cognito)) > 0 ? "authenticate-cognito" : "forward"

# Container definitions
container_definitions = var.custom_container_definitions == "" ? var.atlantis_bitbucket_user_token != "" ? module.container_definition_bitbucket.json : module.container_definition_github_gitlab.json : var.custom_container_definitions

Expand Down Expand Up @@ -178,7 +181,7 @@ module "vpc" {
###################
module "alb" {
source = "terraform-aws-modules/alb/aws"
version = "v5.5.0"
version = "v5.6.0"

name = var.name
internal = var.internal
Expand All @@ -195,12 +198,13 @@ module "alb" {

https_listeners = [
{
target_group_index = 0
port = 443
protocol = "HTTPS"
certificate_arn = var.certificate_arn == "" ? module.acm.this_acm_certificate_arn : var.certificate_arn
action_type = length(keys(var.alb_authenticate_oidc)) > 0 ? "authenticate-oidc" : "forward"
authenticate_oidc = var.alb_authenticate_oidc
target_group_index = 0
port = 443
protocol = "HTTPS"
certificate_arn = var.certificate_arn == "" ? module.acm.this_acm_certificate_arn : var.certificate_arn
action_type = local.alb_authenication_method
authenticate_oidc = var.alb_authenticate_oidc
authenticate_cognito = var.alb_authenticate_cognito
},
]

Expand Down
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,12 @@ variable "alb_authenticate_oidc" {
default = {}
}

variable "alb_authenticate_cognito" {
description = "Map of AWS Cognito authentication parameters to protect ALB (eg, using SAML). See https://www.terraform.io/docs/providers/aws/r/lb_listener.html#authenticate-cognito-action"
type = any
default = {}
}

variable "allow_unauthenticated_access" {
description = "Whether to create ALB listener rule to allow unauthenticated access for certain CIDR blocks (eg. allow GitHub webhooks to bypass OIDC authentication)"
type = bool
Expand Down