feat(VSECPC-12619): AWS GWLB change the way we enable IPv6 on the GW and replace bootcmd commands to script

modules/autoscale_gwlb/README.md

@@ -46,6 +46,7 @@ module "example_module" {
     gateway_name = "asg_gateway"
     gateway_instance_type = "c5.xlarge"
     key_name = "publickey"
+    ip_mode = "IPv4"
     instances_tags = {
         key1 = "value1"
         key2 = "value2"
@@ -66,7 +67,6 @@ module "example_module" {
     allow_upload_download = true
     enable_cloudwatch = false
     gateway_bootstrap_script = "echo 'this is bootstrap script' > /home/admin/bootstrap.txt"
-    enable_ipv6 = false
 }
 ```
 
@@ -85,6 +85,7 @@ module "example_module" {
 | gateway_name                           | The name tag of the Security Gateways instances                                                                                                                                | string       | **Default:** Check-Point-ASG-gateway-tf                                                                       |
 | gateway_instance_type                  | The instance type of the Security Gateways                                                                                                                                    | string       | - c4.large <br/> - c4.xlarge <br/> - c5.large <br/> - c5.xlarge <br/> - c5.2xlarge <br/> - c5.4xlarge <br/> - c5.9xlarge <br/> - c5.12xlarge <br/> - c5.18xlarge <br/> - c5.24xlarge <br/> - c5n.large <br/> - c5n.xlarge <br/> - c5n.2xlarge <br/> - c5n.4xlarge <br/> - c5n.9xlarge <br/>  - c5n.18xlarge <br/>  - c5d.large <br/> - c5d.xlarge <br/> - c5d.2xlarge <br/> - c5d.4xlarge <br/> - c5d.9xlarge <br/> - c5d.12xlarge <br/>  - c5d.18xlarge <br/>  - c5d.24xlarge <br/> - m5.large <br/> - m5.xlarge <br/> - m5.2xlarge <br/> - m5.4xlarge <br/> - m5.8xlarge <br/> - m5.12xlarge <br/> - m5.16xlarge <br/> - m5.24xlarge <br/> - m6i.large <br/> - m6i.xlarge <br/> - m6i.2xlarge <br/> - m6i.4xlarge <br/> - m6i.8xlarge <br/> - m6i.12xlarge <br/> - m6i.16xlarge <br/> - m6i.24xlarge <br/> - m6i.32xlarge <br/> - c6i.large <br/> - c6i.xlarge <br/> - c6i.2xlarge <br/> - c6i.4xlarge <br/> - c6i.8xlarge <br/> - c6i.12xlarge <br/> - c6i.16xlarge <br/> - c6i.24xlarge <br/> - c6i.32xlarge <br/> - c6in.large <br/> - c6in.xlarge <br/> - c6in.2xlarge <br/> - c6in.4xlarge <br/> - c6in.8xlarge <br/> - c6in.12xlarge <br/> - c6in.16xlarge <br/> - c6in.24xlarge <br/> - c6in.32xlarge <br/> - r5.large <br/> - r5.xlarge <br/> - r5.2xlarge <br/> - r5.4xlarge <br/> - r5.8xlarge <br/> - r5.12xlarge <br/> - r5.16xlarge <br/> - r5.24xlarge <br/> - r5a.large <br/> - r5a.xlarge <br/> - r5a.2xlarge <br/> - r5a.4xlarge <br/> - r5a.8xlarge <br/> - r5a.12xlarge <br/> - r5a.16xlarge <br/> - r5a.24xlarge <br/> - r5b.large <br/> - r5b.xlarge <br/> - r5b.2xlarge <br/> - r5b.4xlarge <br/> - r5b.8xlarge <br/> - r5b.12xlarge <br/> - r5b.16xlarge <br/> - r5b.24xlarge <br/> - r5n.large <br/> - r5n.xlarge <br/> - r5n.2xlarge <br/> - r5n.4xlarge <br/> - r5n.8xlarge <br/> - r5n.12xlarge <br/> - r5n.16xlarge <br/> - r5n.24xlarge <br/> - r6i.large <br/> - r6i.xlarge <br/> - r6i.2xlarge <br/> - r6i.4xlarge <br/> - r6i.8xlarge <br/> - r6i.12xlarge <br/> - r6i.16xlarge <br/> - r6i.24xlarge <br/> - r6i.32xlarge <br/> - m6a.large <br/> - m6a.xlarge <br/> - m6a.2xlarge  <br/> - m6a.4xlarge <br/> - m6a.8xlarge <br/> - m6a.12xlarge <br/> - m6a.16xlarge <br/> - m6a.24xlarge <br/> - m6a.32xlarge <br/> - m6a.48xlarge <br/> **Default:** c5.xlarge                            |
 | key_name                               | The EC2 Key Pair name to allow SSH access to the instances                                                                                                                     | string       |                                                                                                               |
+| ip_mode                                | Specifies the IP mode for the GWLB. When set to DualStack, the gateway supports both IPv4 and IPv6 traffic. [Please see version compatibility in the following guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/IPv6-Support.htm)                                                                                                                                      | string        | "IPv4"/"DualStack"<br/>**Default:** "IPv4"                                                                             |
 | volume_size                            | Root volume size (GB) - minimum 100                                                                                                                                            | number       | **Default:** 200                                                                                              |
 | enable_volume_encryption               | Encrypt Environment instances volume with default AWS KMS key                                                                                                                  | bool         | true/false<br>**Default:** true                                                                               |
 | instances_tags                         | (Optional) A map of tags as key=value pairs. All tags will be added to all AutoScaling Group instances                                                                          | map(string)  | **Default:** {}                                                                                               |
@@ -103,7 +104,6 @@ module "example_module" {
 | volume_type                            | General Purpose SSD Volume Type                                                                                                                                               | string       | - gp3<br>- gp2<br>**Default:** gp3                                                                            |
 | gateway_maintenance_mode_password_hash | (Optional) Maintenance-mode password for recovery purposes.                                                                                                                    | string       |                                                                                                               |
  security_rules | List of security rules for ingress and egress.                                                         | list(object({<br/>    direction   = string    <br/>from_port   = any    <br/>to_port     = any <br/>protocol    = any <br/>cidr_blocks = list(any)<br/>}))         | **Default:** []|
-| enable_ipv6                            | Enables dual-stack networking (IPv4 and IPv6) for the GWLB, [Please see version compatibility in the following guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/IPv6-Support.htm)    | bool         | true/false<br>**Default:** false 
 
 
 ## Outputs

modules/autoscale_gwlb/asg_userdata.yaml

@@ -13,17 +13,16 @@ network:
         - *eth0-dns1
     bridge_interfaces:
       - eth0
+  ipv6_enabled: ${IPMode}
 kernel_parameters:
   sim:
     - sim_geneve_enabled=1
     - sim_geneve_br_dev=br0
   fw:
-
     - fwtls_bridge_mode_inspection=1
     - fw_geneve_enabled=1
 bootcmd:
-    - echo "brctl hairpin br0 eth0 on" >> /etc/rc.local
-    - echo "cpprod_util CPPROD_SetValue \"fw1\" \"AwsGwlb\" 4 1 1" >> /etc/rc.local
+    - $CGEDIR/scripts/hairpin_on.sh AwsGwlb
 runcmd:
   - |
     python3 /etc/cloud_config.py enableCloudWatch=\"${EnableCloudWatch}\" sicKey=\"${SICKey}\" installationType=\"autoscale\" osVersion=\"${OsVersion}\" allowUploadDownload=\"${AllowUploadDownload}\" templateVersion=\"1.0.5\" templateName=\"autoscale_gwlb\" templateType=\"terraform_registry\" shell=\"${Shell}\" enableInstanceConnect=\"${EnableInstanceConnect}\" passwordHash=\"${PasswordHash}\" MaintenanceModePassword=\"${MaintenanceModePassword}\" bootstrapScript64=\"${BootstrapScript}\"

modules/autoscale_gwlb/locals.tf

@@ -33,6 +33,10 @@ locals {
 
   regex_valid_cidr_range = "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(/(3[0-2]|2[0-9]|1[0-9]|[0-9]))?$"
 
+  # IPv6 configuration helpers
+  ipv6_enabled = var.ip_mode != "IPv4"
+  ipv4_enabled = var.ip_mode != "IPv6"
+
   tags_asg_format = null_resource.tags_as_list_of_maps.*.triggers
 
   //Splits the version and licence and returns the os version

modules/autoscale_gwlb/main.tf

@@ -15,7 +15,8 @@ resource "aws_security_group" "permissive_sg" {
       from_port   = ingress.value.from_port
       to_port     = ingress.value.to_port
       protocol    = ingress.value.protocol
-      cidr_blocks = ingress.value.cidr_blocks
+      cidr_blocks =  local.ipv4_enabled ? [for cidr in ingress.value.cidr_blocks : cidr if strcontains(cidr, ".")] : []
+      ipv6_cidr_blocks = local.ipv6_enabled ? [for cidr in ingress.value.cidr_blocks : cidr if strcontains(cidr, ":")] : []
     }
   }
 
@@ -25,7 +26,8 @@ resource "aws_security_group" "permissive_sg" {
         from_port    = 0
         to_port      = 0
         protocol     = "-1"
-        cidr_blocks  = ["0.0.0.0/0"]
+        cidr_blocks  = local.ipv4_enabled ? ["0.0.0.0/0"] : []
+        ipv6_cidr_blocks = local.ipv6_enabled ? ["::/0"] : []
     }
   }
 
@@ -35,7 +37,8 @@ resource "aws_security_group" "permissive_sg" {
       from_port   = egress.value.from_port
       to_port     = egress.value.to_port
       protocol    = egress.value.protocol
-      cidr_blocks = egress.value.cidr_blocks
+      cidr_blocks =  local.ipv4_enabled ? [for cidr in egress.value.cidr_blocks : cidr if strcontains(cidr, ".")] : []
+      ipv6_cidr_blocks = local.ipv6_enabled ? [for cidr in egress.value.cidr_blocks : cidr if strcontains(cidr, ":")] : []
     }
   }
 
@@ -45,28 +48,15 @@ resource "aws_security_group" "permissive_sg" {
         from_port    = 0
         to_port      = 0
         protocol     = "-1"
-        cidr_blocks  = ["0.0.0.0/0"]
+        cidr_blocks  = local.ipv4_enabled ? ["0.0.0.0/0"] : []
+        ipv6_cidr_blocks = local.ipv6_enabled ? ["::/0"] : []
     }
   }
   tags = {
     Name = format("%s_PermissiveSecurityGroup", local.asg_name)
   }
 }
 
-resource "aws_vpc_security_group_ingress_rule" "ingress_rule_ipv6" {
-  count = var.enable_ipv6 ? 1 : 0
-  security_group_id = aws_security_group.permissive_sg.id
-  cidr_ipv6         = "::/0"
-  ip_protocol       = "-1"
-  }  
-
-resource "aws_vpc_security_group_egress_rule" "egress_rule_ipv6" {
-  count = var.enable_ipv6 ? 1 : 0
-  security_group_id = aws_security_group.permissive_sg.id
-  cidr_ipv6         = "::/0"
-  ip_protocol       = "-1"
-}
-
 resource "aws_launch_template" "asg_launch_template" {
   name_prefix = local.asg_name
   image_id = module.amis.ami_id
@@ -102,7 +92,7 @@ resource "aws_launch_template" "asg_launch_template" {
 
   description = "Initial template version"
 
-  user_data = base64encode(templatefile("${path.module}/${var.enable_ipv6 ? "asg_userdata_ipv6.yaml" : "asg_userdata.yaml"}", {
+  user_data = base64encode(templatefile("${path.module}/asg_userdata.yaml", {
     // script's arguments
     PasswordHash = local.gateway_password_hash_base64,
     MaintenanceModePassword = local.maintenance_mode_password_hash_base64,
@@ -113,7 +103,7 @@ resource "aws_launch_template" "asg_launch_template" {
     AllowUploadDownload = var.allow_upload_download,
     BootstrapScript = local.gateway_bootstrap_script64,
     OsVersion = local.version_split
-    enable_ipv6 = var.enable_ipv6
+    IPMode = var.ip_mode == "IPv4" ? "false" : "true"
   }))
 }
 resource "aws_autoscaling_group" "asg" {

modules/autoscale_gwlb/output.tf

@@ -39,6 +39,6 @@ output "autoscale_iam_role_name" {
   value = aws_iam_role.role.*.name
 }
 
-output "enable_ipv6"{
-  value = var.enable_ipv6
+output "ip_mode"{
+  value = var.ip_mode
 }

modules/autoscale_gwlb/variables.tf

@@ -194,8 +194,12 @@ variable "security_rules" {
   }))
   default = []
 }
-variable "enable_ipv6" {
-  type = bool
-  description = "Enable IPv6 settings of AWS resources."
-  default = false
+variable "ip_mode" {
+  type = string
+  description = "IP mode of AWS resources."
+  default = "IPv4"
+  validation {
+    condition     = contains(["IPv4", "DualStack"], var.ip_mode)
+    error_message = "The ip_mode value must be one of: IPv4 or DualStack."
+  }
 }