Add variable for publishing egress IP addresses

[dav3r]

🗣 Description

This PR adds a new Terraform variable (publish_egress_ip_addresses) that specifies whether EC2 instances in the operations subnet should be tagged to indicate that their public IP addresses may be published.

💭 Motivation and context

This is useful for deconfliction purposes and it allows us to control publishing of IP addresses on a per-assessment (per-Terraform workspace) basis, which is a requirement of https://github.com/cisagov/cool-system-internal/issues/125.

IP address publishing will be handled via the code in cisagov/publish-egress-ip-lambda and cisagov/publish-egress-ip-terraform.

🧪 Testing

I tested this by running a terraform plan for an environment with:

• publish_egress_ip_addresses = true
• No value set for publish_egress_ip_addresses

In the first case, I confirmed that the plan wanted to set "Publish Egress" = "true" for all of the correct instances/EIPs.
In the second case, I confirmed that the plan wanted to set "Publish Egress" = "false" for all of the correct instances/EIPs.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated
  to reflect the changes in this PR.
• All new and existing tests pass.

✅ Post-merge checklist

• Coordinate with the COOL Operations team to ensure that this new variable is used correctly.
• Update all Staging and Production tfvars files to include publish_egress_ip_addresses

[mcdonnnj]

This seems pretty solid. In addition to my one feedback item I would like to raise maybe making an issue to expand functionality to allow control over which instances of a given type have their IP information published e.g. I want Windows0 to be private but Windows1 to be published.

[dav3r]

This seems pretty solid. In addition to my one feedback item I would like to raise maybe making an issue to expand functionality to allow control over which instances of a given type have their IP information published e.g. I want Windows0 to be private but Windows1 to be published.

@mcdonnnj That's a good idea and we should keep it in mind, but until someone comes to us with that as a requirement, I don't think we need to worry too much about it.

Do I have your approval on this PR?

[mcdonnnj]

This seems pretty solid. In addition to my one feedback item I would like to raise maybe making an issue to expand functionality to allow control over which instances of a given type have their IP information published e.g. I want Windows0 to be private but Windows1 to be published.

@mcdonnnj That's a good idea and we should keep it in mind, but until someone comes to us with that as a requirement, I don't think we need to worry too much about it.

Do I have your approval on this PR?

Yeah I meant it as a "feature idea" issue just to document the thought.

[mcdonnnj]

LGTM ✔

[dav3r]

This seems pretty solid. In addition to my one feedback item I would like to raise maybe making an issue to expand functionality to allow control over which instances of a given type have their IP information published e.g. I want Windows0 to be private but Windows1 to be published.

@mcdonnnj That's a good idea and we should keep it in mind, but until someone comes to us with that as a requirement, I don't think we need to worry too much about it.
Do I have your approval on this PR?

Yeah I meant it as a "feature idea" issue just to document the thought.

Understood - I put this idea in #242. Feel free to make any edits as you see fit.