Creating Time-Based Firewall Rules Using IP Sets for Access Control

Question

Pulumi · Accepted Answer

To create time-based firewall rules using IP sets for access control, Pulumi allows you to define infrastructure as code, which can be used to provision and manage cloud resources. In this context, we will focus on creating time-based firewall rules using the AWS platform. AWS offers services like WAF (Web Application Firewall) that can be adjusted to provide time-based access control by associating them with AWS Lambda for dynamic updates or Amazon CloudFront for static IP restrictions.

Below, I will walk you through a Pulumi TypeScript program that sets up basic AWS infrastructure to illustrate how one might approach the creation of time-based firewall rules. This example will use the AWS WAF and Lambda services. The WAF rules will be updated by the Lambda function, which can be scheduled to run at specific times using Amazon CloudWatch Events (similar to a cron job).

Please note that the actual script that updates the IP set within the Lambda function and the logic for determining the time-based rules are not within the scope of this explanation, but placeholders are provided for you to insert that logic.

Here's the Pulumi code that accomplishes this setup:

```typescript
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

// Create an IP set - this is where you will define the set of IPs allowed access.
const ipSet = new aws.wafv2.IPSet("myIPSet", {
    ipAddressVersion: "IPV4",
    scope: "REGIONAL",
    addresses: [
        // Add initial IP addresses or ranges here. For example, "203.0.113.0/24"
    ],
    // Reference: https://www.pulumi.com/registry/packages/aws/api-docs/wafv2/ipset/
});

// Create a Web ACL that uses the IP set to allow access.
const webAcl = new aws.wafv2.WebAcl("myWebAcl", {
    scope: "REGIONAL",
    defaultAction: { allow: {} },
    visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: "myWebAcl",
        sampledRequestsEnabled: true,
    },
    rules: [
        {
            name: "IPRestrictionRule",
            priority: 1,
            action: { allow: {} },
            statement: {
                ipSetReferenceStatement: {
                    arn: ipSet.arn,
                },
            },
            visibilityConfig: {
                cloudWatchMetricsEnabled: true,
                metricName: "IPRestrictionRule",
                sampledRequestsEnabled: true,
            },
        },
    ],
    // Reference: https://www.pulumi.com/registry/packages/aws/api-docs/wafv2/webacl/
});

// Define your Lambda function here. This function would contain the logic to update the WAF IP set.
const ipSetUpdaterLambda = new aws.lambda.Function("ipSetUpdaterLambda", {
    code: new pulumi.asset.AssetArchive({
        // You could provide a path to the zipped code or inline code depending on your use case.
    }),
    runtime: aws.lambda.NodeJS12dXRuntime,
    role: /* Define or reference an IAM role here */,
    handler: "index.handler",
    // Reference: https://www.pulumi.com/registry/packages/aws/api-docs/lambda/function/
});

// Create a CloudWatch Event Rule that triggers the Lambda function on a schedule.
const rule = new aws.cloudwatch.EventRule("myScheduledRule", {
    scheduleExpression: "cron(0/15 * * * ? *)", // This expression specifies the schedule.
    // Reference: https://www.pulumi.com/registry/packages/aws/api-docs/cloudwatch/eventrule/
});

// Create a permission for the Event Rule to invoke the Lambda function.
new aws.lambda.Permission("lambdaPermission", {
    action: "lambda:InvokeFunction",
    function: ipSetUpdaterLambda,
    principal: "events.amazonaws.com",
    sourceArn: rule.arn,
    // Reference: https://www.pulumi.com/registry/packages/aws/api-docs/lambda/permission/
});

// Connect the Event Rule to the Lambda function using a target.
new aws.cloudwatch.EventTarget("myEventTarget", {
    rule: rule.name,
    arn: ipSetUpdaterLambda.arn,
    // Reference: https://www.pulumi.com/registry/packages/aws/api-docs/cloudwatch/eventtarget/
});

// Export the Web ACL ARN to be used in association with AWS resources (like an API Gateway or a CloudFront distribution).
export const webAclArn = webAcl.arn;
```

In this program:
- We define an `aws.wafv2.IPSet` resource, which represents a set of IP addresses. Initially, this set can contain the IP addresses that are allowed to access your application.
- A `aws.wafv2.WebAcl` resource is created with a rule that references the previously defined IP set. This Web ACL is what enforces access control on your resources and is associated with an ACL rule that allows requests from the IP addresses specified in the IP set.
- A `aws.lambda.Function` resource represents an AWS Lambda function, which you can use to contain the code that will update the IP set on a schedule. The actual Lambda code for updating the IP set should go where the placeholder for the code asset is provided.
- To invoke this Lambda function on a schedule, we create an `aws.cloudwatch.EventRule`. This rule uses a cron expression to define when the function will be triggered.
- A `aws.lambda.Permission` is necessary for the event rule to invoke the Lambda function.
- An `aws.cloudwatch.EventTarget` connects the scheduled event rule with the Lambda function by specifying the rule's name and the function's ARN.

This program is the backbone which provides the necessary AWS resources for a time-based access control system. You'd need to add the specific Lambda code for updating the IP set, and make sure the Lambda function has the right permissions to modify the WAF IP set.