From e2e3346f1628911056eb1c3b7dd34240bb9cddd3 Mon Sep 17 00:00:00 2001 From: badra001 Date: Mon, 16 Dec 2024 10:11:22 -0500 Subject: [PATCH] add table of ports --- emr/README.md | 56 ++++++++++++++++++++++++++++++++++++++++++++++++--- emr/main.tf | 50 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 103 insertions(+), 3 deletions(-) diff --git a/emr/README.md b/emr/README.md index a8c6895..4ca7e4f 100644 --- a/emr/README.md +++ b/emr/README.md @@ -44,6 +44,56 @@ Passing a null or empty list to this field will ignore the ingress setting on th To use all census networks but exclude cloud networks, you may use the prefix list `onprem-networks.core`. ``` +# Security Group Ports: egress + +Egress is not restricted. Each security group allows allows all egress traffic. + +| Source | Port(s) | Protocol | Usage | Comments | +|--------|---------|----------|-------|----------| +| ALL | ALL | ALL | ALL || + +# Security Group Ports: ingress + +## emr-master-node + +| Source | Port(s) | Protocol | Usage | Comments | +|--------|---------|----------|-------|----------| +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 22 | TCP | SSH | | +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 80 | TCP | HTTP | | +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 443 | TCP | HTTPS | | +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 8088 | TCP | Resource Manager | | +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 9870 | TCP | HDFS Name Node | | +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 18080 | TCP | Spark History Server | | +| emr-core-tasks-node, emr-studio, emr-service-access | ALL | ALL | ALL | | +| self | ALL | ALL | ALL | | + +## emr-core-tasks-node + +| Source | Port(s) | Protocol | Usage | Comments | +|--------|---------|----------|-------|----------| +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 9864 | TCP | HDFS Data Node | | +| ingress\_prefix\_list\_names (all-census.core)
ingress\_networks | 8042 | TCP | Node Manager | | +| emr-master-node, emr-service-access | ALL | ALL | ALL | | +| self | ALL | ALL | ALL | | + +## emr-service-access + +| Source | Port(s) | Protocol | Usage | Comments | +|--------|---------|----------|-------|----------| +| emr-master-node | 9443 | TCP | Master Node | | + +## emr-studio-engine + +| Source | Port(s) | Protocol | Usage | Comments | +|--------|---------|----------|-------|----------| +| emr-studio | 18888| TCP | EMR Studio | | + +## emr-studio- + +| Source | Port(s) | Protocol | Usage | Comments | +|--------|---------|----------|-------|----------| +| (none) | | | | | + ## Requirements | Name | Version | @@ -79,11 +129,11 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [description\_prefix](#input\_description\_prefix) | Security Group Description Prefix | `string` | `"Security Group"` | no | -| [egress\_networks](#input\_egress\_networks) | List of egress networks (all ports) | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| [egress\_networks](#input\_egress\_networks) | List of egress networks (all ports) | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | | [ingress\_networks](#input\_ingress\_networks) | List of ingress networks for external access (not all ports). Use null to disable built-in settings | `list(string)` | `[]` | no | -| [ingress\_prefix\_list\_names](#input\_ingress\_prefix\_list\_names) | List of prefix list names for ingress access | `list(string)` | 
[
  "all-networks.core"
]
| no | +| [ingress\_prefix\_list\_names](#input\_ingress\_prefix\_list\_names) | List of prefix list names for ingress access | `list(string)` | 
[
  "all-networks.core"
]
| no | | [name\_prefix](#input\_name\_prefix) | Security Group Name Prefix | `string` | n/a | yes | -| [tags](#input\_tags) | Tags | `map(any)` | 
{
  "CostAllocation": "csvd:infrastructure",
  "Environment": "infrastructure"
}
| no | +| [tags](#input\_tags) | Tags | `map(any)` | 
{
  "CostAllocation": "csvd:infrastructure",
  "Environment": "infrastructure"
}
| no | | [use\_vpc\_cidr](#input\_use\_vpc\_cidr) | Enable\|Disable use of VPC CIDR block in the ingress\_networks | `bool` | `false` | no | | [vpc\_id](#input\_vpc\_id) | VPC ID Number | `string` | n/a | yes | diff --git a/emr/main.tf b/emr/main.tf index 2e1ca8b..21b6c76 100644 --- a/emr/main.tf +++ b/emr/main.tf @@ -44,6 +44,56 @@ * Passing a null or empty list to this field will ignore the ingress setting on these networks. * To use all census networks but exclude cloud networks, you may use the prefix list `onprem-networks.core`. * ``` +* +* # Security Group Ports: egress +* +* Egress is not restricted. Each security group allows allows all egress traffic. +* +* | Source | Port(s) | Protocol | Usage | Comments | +* |--------|---------|----------|-------|----------| +* | ALL | ALL | ALL | ALL || +* +* # Security Group Ports: ingress +* +* ## emr-master-node +* +* | Source | Port(s) | Protocol | Usage | Comments | +* |--------|---------|----------|-------|----------| +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 22 | TCP | SSH | | +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 80 | TCP | HTTP | | +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 443 | TCP | HTTPS | | +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 8088 | TCP | Resource Manager | | +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 9870 | TCP | HDFS Name Node | | +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 18080 | TCP | Spark History Server | | +* | emr-core-tasks-node, emr-studio, emr-service-access | ALL | ALL | ALL | | +* | self | ALL | ALL | ALL | | +* +* ## emr-core-tasks-node +* +* | Source | Port(s) | Protocol | Usage | Comments | +* |--------|---------|----------|-------|----------| +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 9864 | TCP | HDFS Data Node | | +* | ingress_prefix_list_names (all-census.core)
ingress_networks | 8042 | TCP | Node Manager | | +* | emr-master-node, emr-service-access | ALL | ALL | ALL | | +* | self | ALL | ALL | ALL | | +* +* ## emr-service-access +* +* | Source | Port(s) | Protocol | Usage | Comments | +* |--------|---------|----------|-------|----------| +* | emr-master-node | 9443 | TCP | Master Node | | +* +* ## emr-studio-engine +* +* | Source | Port(s) | Protocol | Usage | Comments | +* |--------|---------|----------|-------|----------| +* | emr-studio | 18888| TCP | EMR Studio | | +* +* ## emr-studio- +* +* | Source | Port(s) | Protocol | Usage | Comments | +* |--------|---------|----------|-------|----------| +* | (none) | | | | | */ data "aws_vpc" "this_vpc" {