From af646038f42b94652dc26c6d0d809a8108618476 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Fri, 10 Jul 2026 12:45:05 +0100 Subject: [PATCH 1/4] Fix pentester CIDR range validation The validation used cidrhost(cidr, 32), which errors whenever host number 32 does not fit in the block's host bits, so valid /32 and /27 entries were rejected. This went unnoticed while the lists were empty. Use host number 0, which accepts any valid IPv4 CIDR. Also fix a typo in the error message (last -> list). --- infra/deployments/forms/account/inputs.tf | 4 ++-- infra/deployments/integration/inputs.tf | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/deployments/forms/account/inputs.tf b/infra/deployments/forms/account/inputs.tf index 7cd983dda..cfde3d95c 100644 --- a/infra/deployments/forms/account/inputs.tf +++ b/infra/deployments/forms/account/inputs.tf @@ -101,8 +101,8 @@ variable "pentester_cidr_ranges" { type = list(string) validation { - condition = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 32)]) - error_message = "Each entry in the last must be a valid IPv4 CIDR range" + condition = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 0)]) + error_message = "Each entry in the list must be a valid CIDR range" } validation { diff --git a/infra/deployments/integration/inputs.tf b/infra/deployments/integration/inputs.tf index d604c36e8..d98038f7b 100644 --- a/infra/deployments/integration/inputs.tf +++ b/infra/deployments/integration/inputs.tf @@ -52,8 +52,8 @@ variable "pentester_cidr_ranges" { type = list(string) validation { - condition = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 32)]) - error_message = "Each entry in the list must be a valid IPv4 CIDR range" + condition = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 0)]) + error_message = "Each entry in the list must be a valid CIDR range" } } From d9fd03c6bc136774d8108f20998181ca1b5d8188 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Fri, 10 Jul 2026 12:45:25 +0100 Subject: [PATCH 2/4] Add pentester IP ranges for staging Allow penetration tester traffic from to assume the pentester roles in the staging account. --- .../deploy/engineer-access/roles.tf | 14 ++++++++-- .../forms/account/tfvars/staging.tfvars | 12 ++++++++- infra/deployments/forms/tfvars/staging.tfvars | 26 +++++++++++++------ 3 files changed, 41 insertions(+), 11 deletions(-) diff --git a/infra/deployments/deploy/engineer-access/roles.tf b/infra/deployments/deploy/engineer-access/roles.tf index dd720cd55..16c975550 100644 --- a/infra/deployments/deploy/engineer-access/roles.tf +++ b/infra/deployments/deploy/engineer-access/roles.tf @@ -16,6 +16,16 @@ module "engineer_access" { # Pentesters may not have GDS domains so our pattern using the 'users' module # doesn't necessarily work. - pentesters = [] - pentester_cidrs = [] + pentesters = [] + pentester_cidrs = [ + "88.98.40.224/27", + "172.167.216.147/32", + "3.10.36.101/32", + "35.178.26.242/32", + "18.168.92.160/32", + "18.134.34.111/32", + "13.41.39.172/32", + "20.123.237.233/32", + "88.208.100.190/32" + ] } diff --git a/infra/deployments/forms/account/tfvars/staging.tfvars b/infra/deployments/forms/account/tfvars/staging.tfvars index 6df973c8a..919b5506d 100644 --- a/infra/deployments/forms/account/tfvars/staging.tfvars +++ b/infra/deployments/forms/account/tfvars/staging.tfvars @@ -8,4 +8,14 @@ dns_delegation_records = {} codestar_connection_arn = "arn:aws:codeconnections:eu-west-2:972536609845:connection/065d6101-9c43-4336-8fd4-777f3d6fc791" deploy_account_id = "711966560482" pentester_email_addresses = [] -pentester_cidr_ranges = [] +pentester_cidr_ranges = [ + "88.98.40.224/27", + "172.167.216.147/32", + "3.10.36.101/32", + "35.178.26.242/32", + "18.168.92.160/32", + "18.134.34.111/32", + "13.41.39.172/32", + "20.123.237.233/32", + "88.208.100.190/32" +] diff --git a/infra/deployments/forms/tfvars/staging.tfvars b/infra/deployments/forms/tfvars/staging.tfvars index eaef40bdb..6796e2ac7 100644 --- a/infra/deployments/forms/tfvars/staging.tfvars +++ b/infra/deployments/forms/tfvars/staging.tfvars @@ -16,14 +16,24 @@ environmental_settings = { allow_authentication_from_email_domains = [ ".gov.uk", ] - enable_alert_actions = true - enable_slo_burn_rate_alert_actions = false - forms_product_page_support_url = "https://www.staging.forms.service.gov.uk/support" - rds_maintenance_window = "wed:04:00-wed:04:30" - rds_minimum_capacity_acus = 1 - rds_maxium_capacity_acus = 2 - ips_to_block = [] - rate_limit_bypass_cidrs = [] + enable_alert_actions = true + enable_slo_burn_rate_alert_actions = false + forms_product_page_support_url = "https://www.staging.forms.service.gov.uk/support" + rds_maintenance_window = "wed:04:00-wed:04:30" + rds_minimum_capacity_acus = 1 + rds_maxium_capacity_acus = 2 + ips_to_block = [] + rate_limit_bypass_cidrs = [ + "88.98.40.224/27", + "172.167.216.147/32", + "3.10.36.101/32", + "35.178.26.242/32", + "18.168.92.160/32", + "18.134.34.111/32", + "13.41.39.172/32", + "20.123.237.233/32", + "88.208.100.190/32" + ] enable_shield_advanced_healthchecks = false allow_pagerduty_alerts = false redis_multi_az_enabled = false From 7343f04480591a8a0cde2c207643c7101829f041 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Fri, 10 Jul 2026 14:29:23 +0100 Subject: [PATCH 3/4] Fix path trigger in pentester CIDR guardrail The workflow was missing the tfvars directory in the path for the forms account staging tfvars file, so changes to that file did not trigger the guardrail check. --- .github/workflows/guardrail_matching_pentester_cidr_blocks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml b/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml index 7afc05577..4fb04fc51 100644 --- a/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml +++ b/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml @@ -5,7 +5,7 @@ on: branches: [main] paths: - "infra/deployments/forms/tfvars/staging.tfvars" - - "infra/deployments/forms/account/staging.tfvars" + - "infra/deployments/forms/account/tfvars/staging.tfvars" - "infra/deployments/deploy/engineer-access/roles.tf" - ".github/workflows/guardrail_matching_pentester_cidr_blocks.yml" env: From 4323a3fabba8fdad0ba1224ea49ed652022cc86c Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Fri, 10 Jul 2026 14:33:35 +0100 Subject: [PATCH 4/4] Add pentester accounts for staging Grants the pentesters read-only roles in the staging and deploy accounts, restricted to the pentester CIDR ranges. --- .../deploy/engineer-access/roles.tf | 6 ++++- .../forms/account/tfvars/staging.tfvars | 24 +++++++++++-------- infra/deployments/forms/tfvars/staging.tfvars | 1 + 3 files changed, 20 insertions(+), 11 deletions(-) diff --git a/infra/deployments/deploy/engineer-access/roles.tf b/infra/deployments/deploy/engineer-access/roles.tf index 16c975550..76b47e3fe 100644 --- a/infra/deployments/deploy/engineer-access/roles.tf +++ b/infra/deployments/deploy/engineer-access/roles.tf @@ -16,7 +16,11 @@ module "engineer_access" { # Pentesters may not have GDS domains so our pattern using the 'users' module # doesn't necessarily work. - pentesters = [] + pentesters = [ + "matus.mihok@accenture.com", + "caleb.herbert@accenture.com", + "cameron.steel@accenture.com" + ] pentester_cidrs = [ "88.98.40.224/27", "172.167.216.147/32", diff --git a/infra/deployments/forms/account/tfvars/staging.tfvars b/infra/deployments/forms/account/tfvars/staging.tfvars index 919b5506d..942faa861 100644 --- a/infra/deployments/forms/account/tfvars/staging.tfvars +++ b/infra/deployments/forms/account/tfvars/staging.tfvars @@ -1,13 +1,17 @@ -account_name = "staging" -aws_account_id = "972536609845" -environment_name = "staging" -environment_type = "staging" -require_vpn_to_access = true -apex_domain = "staging.forms.service.gov.uk" -dns_delegation_records = {} -codestar_connection_arn = "arn:aws:codeconnections:eu-west-2:972536609845:connection/065d6101-9c43-4336-8fd4-777f3d6fc791" -deploy_account_id = "711966560482" -pentester_email_addresses = [] +account_name = "staging" +aws_account_id = "972536609845" +environment_name = "staging" +environment_type = "staging" +require_vpn_to_access = true +apex_domain = "staging.forms.service.gov.uk" +dns_delegation_records = {} +codestar_connection_arn = "arn:aws:codeconnections:eu-west-2:972536609845:connection/065d6101-9c43-4336-8fd4-777f3d6fc791" +deploy_account_id = "711966560482" +pentester_email_addresses = [ + "matus.mihok@accenture.com", + "caleb.herbert@accenture.com", + "cameron.steel@accenture.com" +] pentester_cidr_ranges = [ "88.98.40.224/27", "172.167.216.147/32", diff --git a/infra/deployments/forms/tfvars/staging.tfvars b/infra/deployments/forms/tfvars/staging.tfvars index 6796e2ac7..66caabc59 100644 --- a/infra/deployments/forms/tfvars/staging.tfvars +++ b/infra/deployments/forms/tfvars/staging.tfvars @@ -15,6 +15,7 @@ environmental_settings = { database_backup_retention_period_days = 30 allow_authentication_from_email_domains = [ ".gov.uk", + "@accenture.com", ] enable_alert_actions = true enable_slo_burn_rate_alert_actions = false