Elastic Bamboo Security
Elastic Bamboo is a feature in Bamboo that allows Bamboo to dynamically source computing resources from the Amazon Elastic Compute Cloud (EC2).
All traffic sent between the agents located in EC2 and the Bamboo server is tunneled through an SSL-encrypted tunnel. The tunnel will be initiated from the Bamboo Server to the EC2 instance, which means that you don't need to allow any inbound connections to your server. You will need to permit outbound traffic from the server on the tunnel port, however - the default port number is 26224. On the EC2 instance, only the tunnel port needs to be open for inbound traffic.
SSL tunneling is not implemented for VCS (Version Control System) to EC2 traffic though. You will need to make your VCS available for access from EC2 to use Elastic Bamboo. See the section on setting up your VCS for Elastic Bamboo, which contains guidelines on securing your VCS.
Be warned that just as with a regular host accessible from the Internet, if one of your remote agent instances is compromised, your Bamboo installation may be exposed to number of security vulnerabilities. These include confidential data (e.g. source code, VCS credentials) being stolen, malicious code being injected into elastic agents, unauthorized access to build queues and false information being submitted to Bamboo servers. Given that all Bamboo-related traffic is sent through a single encrypted connection, the risk of that happening is not high and can be further mitigated by setting up a VPC (Amazon Virtual Private Cloud). In a VPC, your elastic instances typically have no public IPs which means they are inaccessible from the internet other than through a regular, industry-standard VPN connection.
The sections below explain the default access rules for remote agent instances and how to change these rules, if desired.
On this page:
Related pages:
Default EC2 Access Rules
When you first use Elastic Bamboo, i.e. start an elastic instance, an elasticbamboo security group will be set up for you on your AWS account. This security group is essentially a set of IP addresses that are permitted access to the EC2. By default, the security group will contain two rules — one to allow connections for Elastic Bamboo itself, and another to allow connections via SSH.
The EC2 security groups can be accessed via the AWS management console (see Security groups in the left-hand menu under Configuration).
Changing the Default EC2 Access Rules
If you wish to permit additional connections to your EC2 instance, you can do this by adding entries to the Allowed connections section for the elasticbamboo security group. See the previous section on Default EC2 Access Rules for instructions on how to access your EC2 security groups.
Using VPCs with Elastic Bamboo
VPC functionality is available with Bamboo 4.3. Amazon Virtual Private Cloud (Amazon VPC) lets you provision a private, isolated section of the Amazon Web Services (AWS) Cloud where you can launch AWS resources in a virtual network. By default, the instances running in that network will have no public IPs and will not be accessible to the computers outside of your VPC. You can also create a Hardware Virtual Private Network (VPN) connection between your company datacenter and your VPC and leverage the AWS cloud as an extension of your company datacenter. You can read more about VPCs on Amazon Web Services VPC page.
Using a VPC means that your agents (and other instances launched in the VPC) will not be available on the Internet. There are several basic scenarios that can be realized using a VPC:
- Secure access to your company datacenter - agents can securely access resources from your internal network through a VPN connection. In this way, you can safely use your Version Control System or other internal resources such us databases from your Elastic Agents - without making them publicly accessible.
- Hiding some EC2 instances from the Internet - agents can communicate with your other hosts on the VPC using the internal network. This lets you e.g. set up an agent with a Windows-based DBMS and another one that runs tests against that DBMS from a different platform. Computers from outside of the VPC will not be able to access the DBMS because it will have no external IP. You don't need to use VPN for that use case, it's enough to assign an Elastic IP to the agent.
- Full-cloud deployment - you can host your Bamboo server in an Amazon's VPC and hide all your agents in a VPC. This will also let you access your other resources located in a VPC. The Bamboo Server can be accessed using VPN or an Elastic IP.
Setting up your Version Control System (VCS) for Elastic Bamboo
We recommend that you take the following steps to ensure that your Version Control System is set up securely for Elastic Bamboo:
- Make your Version Control System accessible to the public internet
- Use VCS authentication and access control
- Use encrypted connections to VCS
1. Make your Version Control System accessible to the public internet
You only need to do this if you aren't using a VPC for agent connectivity. See using Bamboo with VPCs for more information.
As SSL tunneling is not implemented for VCS to EC2 connections, you will need to make your VCS accessible to the public internet to use Elastic Bamboo. If your VCS is behind a firewall this will involve configuring an access point in your firewall. Consult the documentation for your firewall software for details on how to do this.
2. Use VCS authentication and access control
We highly recommend that you secure access to your VCS by enabling the authentication and access control features on your VCS. Consult the documentation for your VCS for details.
3. Use encrypted connections to VCS
We also highly recommend that you use encrypted connections for your VCS (e.g. SSL). Consult the documentation for your VCS for details.