cisagov/guacscanner

Scan for EC2 instances added (removed) from a VPC and create (destroy) the corresponding Guacamole connections.

guacscanner

This project is a Python utility that continually scans the EC2 instances in an AWS VPC and adds/removes Guacamole connections in the underlying PostgreSQL database accordingly.

This utility is Dockerized in cisagov/guacscanner-docker, and the resulting Docker container is intended to run as a part of cisagov/guacamole-composition, although it could - probably uselessly - run in a Docker composition alongside only the official PostgreSQL Docker image.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

License

This project is in the worldwide public domain.

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.

guacscanner's Issues

Remove setup duplication in tests

💡 Summary

@mcdonnnj pointed out that there is some duplication among the tests, specifically with the addition of a VPC, subnets, etc. to the mock EC2 service. We should create a test fixture and avoid this duplication.

Motivation and context

DRY code is better code, even if it's test code.

Improve creation of Guacamole user(s)

💡 Summary

Figure out a way to make the creation of the Guacamole user cleaner and more flexible. We don't want to hard code the Guacamole user name, and we want to allow users to specify a list of Guacamole users that should be created if they don't exist and given access to use the connections created by guacscanner.

Motivation and context

We should allow the flexibility to use this utility in a myriad of ways, not just in ways that match our use case.

Implementation notes

It might make sense to allow for an AMI name regex to be associated with each Guacamole user. If an instance's AMI's name matches the regex then the user will be allowed to use the connection.

Add CLI flags for remaining global default variables

💡 Summary

Add CLI flags (with defaults) for the remaining global DEFAULT_* variables.

Motivation and context

Everything should be configurable.

Simplify construction of DB queries

💡 Summary

Determine if we can use f-strings instead of .format() for the PostgreSQL query variables. Also define the sql.Identifier() variables outside of the query constructions so that they can be reused where that is possible.

Motivation and context

Simplify, simplify.

Improve exception handling

💡 Summary

Improve exception handling for all the database accesses and wherever else it is appropriate.

Motivation and context

guacscanner currently just bombs out if an exception is thrown, and it shouldn't throw any exceptions for our use case, but it would probably make more sense to print an error message and keep looping, keepin' the train a-chooglin'.

Add type hints to the project

💡 Summary

The code for this project should include type hints.

Motivation and context

Type hints are very useful for static analysis of Python code and we try to include them in our Python projects.

Break up the contents of the `guacscanner` package

💡 Summary

The functionality of the guacscanner package is almost entirely in the guacscanner module. We should break up the functionality into separate modules to at minimum separate the command-line interface from the core functionality of the package.

Motivation and context

Breaking up the functionality will make this package more directly usable by other software as well as improve maintainability by separating functionally distinct elements.

Implementation notes

I suggested separating command-line functionality, but there may be other elements that would benefit from being "broken up".

Acceptance criteria

• MVP is CLI functionality is broken out into its own module.

Validate region passed in on the command line

💡 Summary

We should verify that any region name passed in via the command line is indeed a valid region.

Motivation and context

It is better to catch errors earlier rather than later.

Implementation notes

This boto3 method should do the trick.

Loosen up pinned versions in setup.py

💡 Summary

Instead of pinning the pip package versions to tightly in setup.py, we should instead pin them loosely there and let pipenv or similar in the deploying environment do the heavy lifting.

Motivation and context

@mcdonnnj mentioned this improvement here.