Harden the IaaS environment created by the PCF pipelines.
Apply the harden-network
YAML patch to the install-pcf
pipeline for AWS before loading the pipeline into Concourse. No
additional parameters are required.
- Lock down security groups
- Create VPC Endpoints for S3 and EC2
- Encrypt S3 buckets
- Currently supports only AWS.
- Assure that Cloud Controller and BOSH director have appropriate S3 access
- Test further
- Add BOSH disk encryption (likely as another task)
I quickly extracted this from my bootstrap repository and applied minimal testing. This may bork your PCF environment.