Merge pull request 'fix: open preview security groups by default' (#5) from fix/open-preview-security-groups into main

Reviewed-on: #5

SPEC.md

@@ -177,7 +177,7 @@ pp:previewId = <Preview.id>
 
 **EC2 setup per preview:**
 1. Generate an ephemeral RSA key pair. Store the private key encrypted in `Preview.sshPrivateKey`. Import the public key to AWS as `pp-preview-<previewId>` and store the name in `Preview.sshKeyName`.
-2. Create a security group named `pp-preview-<previewId>` in the default VPC. Allow inbound: TCP 22 (SSH) and TCP `<port>` from `0.0.0.0/0`.
+2. Create a security group named `pp-preview-<previewId>` in the default VPC. Allow inbound: all traffic from `0.0.0.0/0` and `::/0` (all protocols, including ICMP, and all ports).
 3. Launch instance:
    - AMI: Ubuntu 22.04 LTS (hardcode a per-region AMI map, or resolve via SSM `resolve:ssm:/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id`)
    - Instance type from `RepoConfig.instanceType`

backend/src/services/ec2.ts

@@ -84,7 +84,9 @@ export async function createPreviewSecurityGroup(ec2: EC2Client, groupName: stri
     Filters: [{ Name: "group-name", Values: [groupName] }],
   }));
   if (describe.SecurityGroups && describe.SecurityGroups.length > 0) {
-    return describe.SecurityGroups[0].GroupId!;
+    const groupId = describe.SecurityGroups[0].GroupId!;
+    await ensurePreviewSecurityGroupOpen(ec2, groupId);
+    return groupId;
   }
 
   const res = await ec2.send(new CreateSecurityGroupCommand({
@@ -93,30 +95,28 @@ export async function createPreviewSecurityGroup(ec2: EC2Client, groupName: stri
   }));
   const groupId = res.GroupId!;
 
-  const ingress: any[] = [
-    {
-      IpProtocol: "tcp",
-      FromPort: 22,
-      ToPort: 22,
-      IpRanges: [{ CidrIp: "0.0.0.0/0" }],
-    },
-  ];
-  if (port !== 22) {
-    ingress.push({
-      IpProtocol: "tcp",
-      FromPort: port,
-      ToPort: port,
-      IpRanges: [{ CidrIp: "0.0.0.0/0" }],
-    });
-  }
-
-  await ec2.send(new AuthorizeSecurityGroupIngressCommand({
-    GroupId: groupId,
-    IpPermissions: ingress,
-  }));
+  await ensurePreviewSecurityGroupOpen(ec2, groupId);
   return groupId;
 }
 
+async function ensurePreviewSecurityGroupOpen(ec2: EC2Client, groupId: string): Promise<void> {
+  try {
+    await ec2.send(new AuthorizeSecurityGroupIngressCommand({
+      GroupId: groupId,
+      IpPermissions: [
+        {
+          IpProtocol: "-1",
+          IpRanges: [{ CidrIp: "0.0.0.0/0" }],
+          Ipv6Ranges: [{ CidrIpv6: "::/0" }],
+        },
+      ],
+    }));
+  } catch (e: any) {
+    if (e.name === "InvalidPermission.Duplicate") return;
+    throw e;
+  }
+}
+
 const BOOTSTRAP_SCRIPT = `#!/bin/bash
 set -euo pipefail
 exec > >(tee -a /var/log/pp-bootstrap.log) 2>&1