[laspsandoval]

Change Summary

Overview

NOAA requested using a PING to our EC2 instance. So I opened the security group temporarily for testing in dev.

The ISA required VPC flow logs. This PR address that:

• Monitor traffic through the private subnet where the VPN tunnel terminates / VPC Flow Logs
• Capture both success (ACCEPT) and dropped-packet (REJECT) records automatically for this resource type.
• Capture Date and Time, Source and destination IP addresses, port numbers
• Audit logs for the receiving boundary are retained for a minimum of 30-days online
• VPC flow log monitoring added.

[Copilot]

🟡 Changes recommended

The new ICMP allowance is not scoped in a way that matches the “temporary dev testing” intent and the ICMP rule is broader than necessary for ping-only access.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds auditability and connectivity testing support for the I-ALiRT/NOAA interconnection by introducing Transit Gateway attachment flow logging and enabling NOAA-originated ICMP (ping) to the ECS security group.

Changes:

• Add CloudWatch Log Group + Transit Gateway VPC attachment Flow Log to capture NOAA VPN traffic (ACCEPT/REJECT) for monitoring/audit needs.
• Update I-ALiRT processing ECS security group rules to allow inbound ICMP from NOAA CIDR(s) to support ping testing.

File summaries

File	Description
sds_data_manager/utils/ialirt_noaa_vpn.py	Creates CloudWatch log group and attaches TGW attachment flow logs for NOAA VPN traffic monitoring.
sds_data_manager/constructs/ialirt_processing_construct.py	Adds optional ICMP ingress for NOAA partner CIDR(s) in the ECS security group.

Review details

Suppressed comments (1)

sds_data_manager/constructs/ialirt_processing_construct.py:152

• ec2.Port.all_icmp() allows all ICMP types/codes from NOAA’s CIDR, which is broader than required for a simple ping test. If the goal is strictly ping reachability, consider restricting this to ICMP echo request (type 8) to minimize allowed traffic.

                    self.ecs_security_group.add_ingress_rule(
                        peer=ec2.Peer.ipv4(cidr),
                        connection=ec2.Port.all_icmp(),
                        description=f"Allow inbound ICMP (ping) from {partner}",

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.