From cb258302ea03465b017e2b8a8a7c30e1e91ac87d Mon Sep 17 00:00:00 2001
From: Corey Ham <32488787+cham423@users.noreply.github.com>
Date: Fri, 1 Oct 2021 11:38:49 -0700
Subject: [PATCH] adding hacky CloudFront firewall script for opsec

---
 cloudfront_opsec.sh | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 cloudfront_opsec.sh

diff --git a/cloudfront_opsec.sh b/cloudfront_opsec.sh
new file mode 100644
index 0000000..612e1c5
--- /dev/null
+++ b/cloudfront_opsec.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+apt install ufw
+ufw allow ssh
+ufw default deny incoming
+ufw default allow outgoing
+for ip in $(curl https://ip-ranges.amazonaws.com/ip-ranges.json | jq '.prefixes[] | select(.service? == "CLOUDFRONT") | .ip_prefix?' | tr -d '"'); do ufw allow proto tcp from $ip to any port 80,443; done
+ufw enable