├── .gitignore ├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── Dockerfile ├── LICENSE ├── README.md ├── aws_proxy_pattern.png ├── provider.tf ├── proxy ├── proxy_user_data.sh ├── root.tf └── variables.tf ├── root.tf ├── variables.tf └── vpc ├── root.tf └── variables.tf /.gitignore: -------------------------------------------------------------------------------- 1 | *.swp 2 | *.tfstate* 3 | .terraform/ 4 | terraform.tfvars 5 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Contributor Covenant Code of Conduct 2 | 3 | ## Our Pledge 4 | 5 | In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. 6 | 7 | ## Our Standards 8 | 9 | Examples of behavior that contributes to creating a positive environment include: 10 | 11 | * Using welcoming and inclusive language 12 | * Being respectful of differing viewpoints and experiences 13 | * Gracefully accepting constructive criticism 14 | * Focusing on what is best for the community 15 | * Showing empathy towards other community members 16 | 17 | Examples of unacceptable behavior by participants include: 18 | 19 | * The use of sexualized language or imagery and unwelcome sexual attention or advances 20 | * Trolling, insulting/derogatory comments, and personal or political attacks 21 | * Public or private harassment 22 | * Publishing others' private information, such as a physical or electronic address, without explicit permission 23 | * Other conduct which could reasonably be considered inappropriate in a professional setting 24 | 25 | ## Our Responsibilities 26 | 27 | Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. 28 | 29 | Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. 30 | 31 | ## Scope 32 | 33 | This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. 34 | 35 | ## Enforcement 36 | 37 | Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at opensource@nearform.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. 38 | 39 | Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. 40 | 41 | ## Attribution 42 | 43 | This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version] 44 | 45 | [homepage]: http://contributor-covenant.org 46 | [version]: http://contributor-covenant.org/version/1/4/ 47 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Welcome to XYZ! 2 | 3 | Please take a second to read over this before opening an issue. Providing complete information upfront will help us address any issue (and ship new features!) faster. 4 | 5 | We greatly appreciate bug fixes, documentation improvements and new features, however when contributing a new major feature, it is a good idea to idea to first open an issue, to make sure the feature it fits with the goal of the project, so we don't waste your or our time. 6 | 7 | ## Bug Reports 8 | 9 | A perfect bug report would have the following: 10 | 11 | 1. Summary of the issue you are experiencing. 12 | 2. Details on what versions of node and XZY you are using (`node -v`). 13 | 3. A simple repeatable test case for us to run. Please try to run through it 2-3 times to ensure it is completely repeatable. 14 | 15 | We would like to avoid issues that require a follow up questions to identify the bug. These follow ups are difficult to do unless we have a repeatable test case. 16 | 17 | 18 | ## For Developers 19 | 20 | All contributions should fit the [standard](https://github.com/standard/standard) linter, and pass the tests. 21 | You can test this by running: 22 | 23 | ``` 24 | npm test 25 | ``` 26 | 27 | In addition, make sure to add tests for any new features. 28 | You can test the test coverage by running: 29 | 30 | ``` 31 | npm run ci-cov 32 | ``` 33 | 34 | ## For Collaborators 35 | 36 | Make sure to get a `:thumbsup:`, `+1` or `LGTM` from another collaborator before merging a PR. If you aren't sure if a release should happen, open an issue. 37 | 38 | Release process: 39 | 40 | - `npm test` 41 | - `npm version ` 42 | - `git push && git push --tags` 43 | - `npm publish` 44 | 45 | ----------------------------------------- 46 | 47 | 48 | ## Developer's Certificate of Origin 1.1 49 | 50 | By making a contribution to this project, I certify that: 51 | 52 | * (a) The contribution was created in whole or in part by me and I 53 | have the right to submit it under the open source license 54 | indicated in the file; or 55 | 56 | * (b) The contribution is based upon previous work that, to the best 57 | of my knowledge, is covered under an appropriate open source 58 | license and I have the right under that license to submit that 59 | work with modifications, whether created in whole or in part 60 | by me, under the same open source license (unless I am 61 | permitted to submit under a different license), as indicated 62 | in the file; or 63 | 64 | * (c) The contribution was provided directly to me by some other 65 | person who certified (a), (b) or (c) and I have not modified 66 | it. 67 | 68 | * (d) I understand and agree that this project and the contribution 69 | are public and that a record of the contribution (including all 70 | personal information I submit with it, including my sign-off) is 71 | maintained indefinitely and may be redistributed consistent with 72 | this project or the open source license(s) involved. 73 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM alpine:latest 2 | 3 | RUN apk add squid 4 | 5 | ENTRYPOINT ["squid", "-NYCd 1"] 6 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright 2018 nearForm 2 | 3 | Licensed under the Apache License, Version 2.0 (the "License"); 4 | you may not use this file except in compliance with the License. 5 | You may obtain a copy of the License at 6 | 7 | http://www.apache.org/licenses/LICENSE-2.0 8 | 9 | Unless required by applicable law or agreed to in writing, software 10 | distributed under the License is distributed on an "AS IS" BASIS, 11 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | See the License for the specific language governing permissions and 13 | limitations under the License. -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # aws-proxy-pattern 2 | 3 | ## Description 4 | 5 | ![high level design](aws_proxy_pattern.png) 6 | 7 | A fairly common security best practice is to send outbound internet traffic 8 | through a proxy to facilitate monitoring and filtering. Transparent proxies 9 | make this easier by not requiring any specific configuration on the hosts. 10 | 11 | This repository contains terraform modules to create such a proxy with an 12 | example network in AWS VPC to show how it works. 13 | 14 | The blog article related to this repo can be found at: 15 | 16 | https://www.nearform.com/blog/building-a-transparent-proxy-in-aws-vpc-with-terraform-and-squid/ 17 | 18 | ## Building 19 | 20 | 1. `terraform init` in the project root 21 | 2. Change the `provider.tf` profile if necessary to match your 22 | `~/.aws/credentials` profile name if it is not `default`. 23 | 3. Create a new EC2 key pair or use an existing one and provide the key pair 24 | name to terraform as a variable, this will be used to protect access to the 25 | instances in the example network. An easy way to do this is to add a file 26 | called `terraform.tfvars` to the root of the project containing the line: 27 | `key_pair_name = ""` 28 | 4. `terraform plan` 29 | 5. `terraform apply` 30 | 31 | ## Testing 32 | 33 | Use the IP addresses output by terraform to SSH into the example host through 34 | the management host. Ensure you have SSH agent forwarding on to make this work, 35 | see the blog article for specific steps. 36 | 37 | Running `curl http://www.amazonaws.com` and `curl http://baddomain.com` should 38 | show that traffic is going through and being filtered by the proxy. This can be 39 | further verified over SSH to the proxy directly by tailing 40 | `/var/log/squid/access.log`. 41 | 42 | ## License 43 | 44 | Copyright nearForm Ltd 2018. Licensed under [Apache 2.0 license](LICENSE) 45 | 46 | ## Contributing 47 | 48 | We have a [contributing guide](CONTRIBUTING.md) and a [code of conduct](CODE_OF_CONDUCT.md). 49 | -------------------------------------------------------------------------------- /aws_proxy_pattern.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nearform/aws-proxy-pattern/cbd67437c447b388938b2a100f1e34f74e7c9e7d/aws_proxy_pattern.png -------------------------------------------------------------------------------- /provider.tf: -------------------------------------------------------------------------------- 1 | # Uses ~/.aws/credentials, default profile 2 | provider "aws" { 3 | region = "${var.region}" 4 | profile = "default" 5 | } 6 | 7 | -------------------------------------------------------------------------------- /proxy/proxy_user_data.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | set -x 3 | 4 | # Install latest Docker 5 | apt update 6 | apt-get install -y \ 7 | apt-transport-https \ 8 | ca-certificates \ 9 | curl \ 10 | software-properties-common 11 | curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - 12 | add-apt-repository \ 13 | "deb [arch=amd64] https://download.docker.com/linux/ubuntu \ 14 | $(lsb_release -cs) \ 15 | stable" 16 | apt update 17 | apt install -y docker-ce 18 | 19 | # Create squid configuration 20 | mkdir /etc/squid 21 | cat | tee /etc/squid/squid.conf <