Setting the file. One moment.
Check Security Groups · RDS Oracle · aws/agent-toolkit-for-aws · Skills Docs
Back to the top of the page 10
Setup DevOps Agent
33
AWS Deployment
RDS Oracle
(opens in a new tab)
scripts/ check_security_groups.sh
Shell · 110 lines · 3 KB
=
"
${2
:-
}
"
12 REGION = " ${3 :- } "
13
14 REGION_ARGS = ()
15 if [ -n " $REGION " ]; then
16 REGION_ARGS = ( --region " $REGION " )
17 fi
18
19 echo "=== Security Group Check for RDS Oracle ==="
20 echo "Instance: ${ INSTANCE_ID }"
21 echo "Source: ${ SOURCE :- any }"
22 echo "Time: $( date )"
23 echo ""
24
25 PORT = $( aws rds describe-db-instances \
26 --db-instance-identifier "${ INSTANCE_ID }" \
27 "${ REGION_ARGS [ @ ]}" \
28 --query 'DBInstances[0].Endpoint.Port' --output text 2> /dev/null )
29
30 if [ -z " $PORT " ] || [ " $PORT " = "None" ]; then
31 echo "FAIL: Cannot find instance '${ INSTANCE_ID }'"
32 exit 1
33 fi
34
35 [[ " $PORT " =~ ^[0-9]+$ ]] || { echo "FAIL: Invalid port value '${ PORT }'" ; exit 1 ; }
36
37 echo "Oracle port: ${ PORT }"
38 echo ""
39
40 SG_IDS = $( aws rds describe-db-instances \
41 --db-instance-identifier "${ INSTANCE_ID }" \
42 "${ REGION_ARGS [ @ ]}" \
43 --query 'DBInstances[0].VpcSecurityGroups[*].VpcSecurityGroupId' --output text )
44
45 FOUND_RULE = false
46
47 for SG_ID in ${SG_IDS}; do
48 echo "--- Security Group: ${ SG_ID } ---"
49
50 RULES = $( aws ec2 describe-security-groups \
51 --group-ids "${ SG_ID }" \
52 "${ REGION_ARGS [ @ ]}" \
53 --query 'SecurityGroups[0].IpPermissions' --output json )
54
55 ORACLE_RULES = $( echo "${ RULES }" | PORT = "${ PORT }" python3 -c "
56 import json, sys, os
57 rules = json.load(sys.stdin)
58 port = int(os.environ['PORT'])
59 for rule in rules:
60 from_port = rule.get('FromPort', 0)
61 to_port = rule.get('ToPort', 0)
62 if from_port <= port <= to_port or (from_port == 0 and to_port == 0):
63 sources = []
64 for cidr in rule.get('IpRanges', []):
65 sources.append(cidr.get('CidrIp', ''))
66 for sg in rule.get('UserIdGroupPairs', []):
67 sources.append(sg.get('GroupId', ''))
68 for prefix in rule.get('PrefixListIds', []):
69 sources.append(prefix.get('PrefixListId', ''))
70 for src in sources:
71 print(f' Port {from_port}-{to_port}: {src}')
72 " 2> /dev/null )
73
74 if [ -n "${ ORACLE_RULES }" ]; then
75 echo " Inbound rules allowing port ${ PORT }:"
76 echo "${ ORACLE_RULES }"
77
78 if [ -n "${ SOURCE }" ]; then
79 if echo "${ ORACLE_RULES }" | grep -qF "${ SOURCE }" ; then
80 echo " PASS: Source '${ SOURCE }' is allowed"
81 FOUND_RULE = true
82 else
83 echo " WARN: Source '${ SOURCE }' NOT found in rules"
84 fi
85 else
86 FOUND_RULE = true
87 fi
88 else
89 echo " WARN: No inbound rules found for port ${ PORT }"
90 fi
91 echo ""
92 done
93
94 if [ "${ FOUND_RULE }" = true ]; then
95 if [ -n "${ SOURCE }" ]; then
96 echo "=== PASS: Security group allows ${ SOURCE } on port ${ PORT } ==="
97 else
98 echo "=== PASS: Security group has rules for port ${ PORT } ==="
99 fi
100 else
101 echo "=== FAIL: No matching security group rule found ==="
102 echo " Fix: Add an inbound rule to the RDS security group:"
103 echo " Protocol: TCP"
104 echo " Port: ${ PORT }"
105 if [ -n "${ SOURCE }" ]; then
106 echo " Source: ${ SOURCE }"
107 else
108 echo " Source: <your-application-security-group-or-cidr>"
109 fi
110 fi