Allow taurus AD private instance access to broker

[DaMandal0rian]

PR Type

Enhancement

---

Description

• Add temporary ingress rule for external IP

• Permit RabbitMQ access on port 5671/5672

• Annotate rule for testing purposes

---

Changes walkthrough 📝

	Relevant files
Configuration changes	broker.tf` Add external IP access to RabbitMQ UI                                        resources/terraform/auto-drive/broker.tf Insert new ingress block for testing Permit port 15671 from 136.243.147.181/32 Add description for external access
Additional files	broker.tf +9/-0

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Ingress exposure: The new rule permits public access to port 5671 from the specified external IP, increasing attack surface. Even if temporary, it can be overlooked and retained in production. Use parameterized CIDR blocks, enforce tighter restrictions, and ensure automatic removal of test-only rules.

⚡ Recommended focus areas for review Hardcoded IP The external IP is hardcoded into the Terraform ingress rule, making updates error-prone and reducing flexibility. Consider parameterizing this address via a variable or data source. # Allow from specific external IP address temporarily for testing purposes ingress { from_port = 5671 to_port = 5671 protocol = "tcp" cidr_blocks = ["136.243.147.181/32"] description = "Allow RabbitMQ access from external IP" } Temporary rule cleanup The temporary ingress rule lacks an automated teardown mechanism, risking prolonged exposure. Implement a lifecycle or automation to revoke this rule after testing completes. # Allow from specific external IP address temporarily for testing purposes ingress { from_port = 5671 to_port = 5671 protocol = "tcp" cidr_blocks = ["136.243.147.181/32"] description = "Allow RabbitMQ access from external IP" }

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Make external access rule conditional Extract this temporary external access rule into its own aws_security_group_rule with a conditional count and a variable for the CIDR block. This allows you to enable or disable the rule without modifying the shared security group resource directly. resources/terraform/auto-drive/broker.tf [127-133] -ingress { - from_port = 15671 - to_port = 15671 - protocol = "tcp" - cidr_blocks = ["136.243.147.181/32"] - description = "Allow RabbitMQ Web UI access from external IP" +resource "aws_security_group_rule" "rabbitmq_temp_external_access" { + count = var.enable_temp_external_access ? 1 : 0 + type = "ingress" + from_port = 15671 + to_port = 15671 + protocol = "tcp" + cidr_blocks = [var.temp_access_cidr] + description = "Temporary RabbitMQ Web UI access from external IP" + security_group_id = aws_security_group.rabbitmq_broker_primary.id } Suggestion importance[1-10]: 7 __ Why: Extracting the temporary ingress rule into a dedicated aws_security_group_rule with conditional count and a variable improves modularity and enables easy toggling without changing the core security group resource.	Medium