| 150 | |
| 151 | /** Create (idempotently) a security group allowing inbound SSH from this host. */ |
| 152 | const ensureSecurityGroup = async (myIp: string): Promise<string> => { |
| 153 | const name = `${TAG}-sg`; |
| 154 | let sg = await aws([ |
| 155 | "ec2", |
| 156 | "describe-security-groups", |
| 157 | "--filters", |
| 158 | `Name=group-name,Values=${name}`, |
| 159 | "--query", |
| 160 | "SecurityGroups[0].GroupId", |
| 161 | ]).catch(() => ""); |
| 162 | if (!sg || sg === "None") { |
| 163 | sg = await aws([ |
| 164 | "ec2", |
| 165 | "create-security-group", |
| 166 | "--group-name", |
| 167 | name, |
| 168 | "--description", |
| 169 | "executor e2e ephemeral guests (SSH from CI host)", |
| 170 | "--query", |
| 171 | "GroupId", |
| 172 | ]); |
| 173 | } |
| 174 | // Authorize this host's IP for SSH; ignore "already exists". |
| 175 | await aws([ |
| 176 | "ec2", |
| 177 | "authorize-security-group-ingress", |
| 178 | "--group-id", |
| 179 | sg, |
| 180 | "--protocol", |
| 181 | "tcp", |
| 182 | "--port", |
| 183 | "22", |
| 184 | "--cidr", |
| 185 | `${myIp}/32`, |
| 186 | ]).catch(() => undefined); |
| 187 | return sg; |
| 188 | }; |
| 189 | |
| 190 | /** PowerShell user-data: enable OpenSSH, default the shell to PowerShell, and |
| 191 | * authorize our public key for the Administrator account. */ |