Hongming Wang
|
e1d65607cf
|
feat(security): Phase 35.1 — SG lockdown script for tenant EC2 instances
Restricts tenant EC2 port 8080 ingress to Cloudflare IP ranges only,
blocking direct-IP access. Supports two modes:
1. Lock to CF IPs (Worker deployment): 14 IPv4 CIDR rules
2. Close ingress entirely (Tunnel deployment): removes 0.0.0.0/0 only
Usage:
bash scripts/lockdown-tenant-sg.sh --sg-id sg-xxxxx
bash scripts/lockdown-tenant-sg.sh --sg-id sg-xxxxx --close-ingress
bash scripts/lockdown-tenant-sg.sh --sg-id sg-xxxxx --dry-run
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-18 12:01:41 -07:00 |
|