Update security group with specific IP range to only allow gitlab-ci to communicate with custom runner

user_1050507 0
Viewed 1187

I've followed https://docs.gitlab.com/runner/configuration/runner_autoscale_aws_fargate/ to create a custom runner which has a public IP attached and sits in a VPC alongside "private" resources. The runner is used to apply migrations using gitlab ci/cd.

ALLOW 22 0.0.0.0/0 has been applied within the security group; but it's wide open to attacks. What IP range do I need to add to only allow gitlab ci/cd runners access via SSH? I've removed that rule for the moment so we're getting connection errors, but the IPs connecting on port 22 all come from AWS (assuming gitlab runners are also on AWS).

Is there something I'm missing or not understanding?

continuous-deployment gitlab devops amazon-web-services continuous-integration
2 Answers

I had a look at the tutorial. you should only allow EC2 instances to be able to ssh into the Fargate tasks.

One way to do that is, You could define EC2 instance's security group as the source in the Fargate task's security group instead of using an ip address(or CIDR block). You don't have to explicitly mention any ip ranges. This is my preferred approach.

When you specify a security group as the source for a rule, traffic is allowed from the network interfaces that are associated with the source security group for the specified protocol and port. Incoming traffic is allowed based on the private IP addresses of the network interfaces that are associated with the source security group (and not the public IP or Elastic IP addresses).specify a security group as the source

Second approach is, As @samtoddler mentioned, you can allow the entire VPC network, or you can restrict it to a subnet.

user_14486790

I was misunderstood; gitlab-runner talks to gitlab, not the other way round, my understanding was gitlab talks to runners over SSH.

My immediate solution was 2 things:

  • Move the EC2 instance into a private subnet
  • As per @Aruk Ks answer, only allow EC2 to communicate over SSH to ECS Fargate tasks

This answered my question as well https://forum.gitlab.com/t/gitlab-runner-on-private-ip/19673

user_10505070
Related