Implement IP cleanup when job is completed

README.md

@@ -2,6 +2,7 @@
 
 This action will add your public ip address to your given aws security group(s) with a description.
 If any ip address already exists with the description then it will update the address instead of adding.
+And it will remove the added ip address once the main job is completed.
 
 ## Inputs
 

action.yml

@@ -27,4 +27,5 @@ inputs:
     default: 'GitHub Action'
 runs:
   using: 'node12'
-  main: 'dist/index.js'
+  main: 'dist/main/index.js'
+  post: 'dist/cleanup/index.js'

package.json

@@ -2,10 +2,10 @@
   "name": "aws-security-group-add-ip",
   "version": "1.0.0",
   "description": "Add IP address to your AWS security group",
-  "main": "index.js",
+  "main": "src/main.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
-    "package": "ncc build index.js -m -o dist"
+    "package": "ncc build src/main.js -m -o dist/main && ncc build src/cleanup.js -m -o dist/cleanup"
   },
   "keywords": [
     "aws",
@@ -19,5 +19,8 @@
     "@actions/core": "^1.2.4",
     "aws-sdk": "^2.670.0",
     "public-ip": "^4.0.1"
+  },
+  "devDependencies": {
+    "@zeit/ncc": "^0.22.2"
   }
 }

src/cleanup.js

@@ -0,0 +1,25 @@
+const publicIp = require('public-ip');
+
+const config = require('./config');
+
+async function run() {
+  try {
+    const myPublicIp = await publicIp.v4();
+
+    for (const groupId of config.groupIds) {
+      await config.ec2.revokeSecurityGroupIngress({
+        GroupId: groupId,
+        CidrIp: `${myPublicIp}/32`,
+        IpProtocol: 'tcp',
+        FromPort: config.port,
+        ToPort: config.port,
+      }).promise();
+    }
+
+    console.log(`The IP ${myPublicIp} is removed`);
+  } catch (error) {
+    core.setFailed(error.message);
+  }
+}
+
+run();

src/config.js

@@ -0,0 +1,30 @@
+const core = require('@actions/core');
+const AWS = require('aws-sdk/global');
+const EC2 = require('aws-sdk/clients/ec2');
+
+const region = core.getInput('aws-region', { required: true });
+const accessKeyId = core.getInput('aws-access-key-id', { required: true });
+const secretAccessKey = core.getInput('aws-secret-access-key', { required: true });
+const groupIds = core
+  .getInput('aws-security-group-id', { required: true })
+  .split(',')
+  .map(item => item.trim());
+const port = parseInt(core.getInput('port', { required: false }));
+const description = core.getInput('description', { required: false });
+
+AWS.config.update({
+  region,
+  accessKeyId,
+  secretAccessKey,
+});
+const ec2 = new EC2();
+
+module.exports = {
+  region,
+  accessKeyId,
+  secretAccessKey,
+  groupIds,
+  port,
+  description,
+  ec2,
+};

src/main.js

@@ -0,0 +1,53 @@
+const core = require('@actions/core');
+const publicIp = require('public-ip');
+
+const config = require('./config');
+
+async function run() {
+  try {
+    const result = await config.ec2.describeSecurityGroups({
+      GroupIds: config.groupIds,
+    }).promise();
+
+    for (const group of result.SecurityGroups) {
+      const ruleByPort = group.IpPermissions
+        .find(permission => permission.FromPort === config.port);
+
+      if (ruleByPort) {
+        const ipByDesc = ruleByPort.IpRanges
+          .find(ip => ip.Description === config.description);
+
+        if (ipByDesc) {    
+          await config.ec2.revokeSecurityGroupIngress({
+            GroupId: group.GroupId,
+            CidrIp: ipByDesc.CidrIp,
+            IpProtocol: 'tcp',
+            FromPort: config.port,
+            ToPort: config.port,
+          }).promise();
+        }
+      }
+
+      const myPublicIp = await publicIp.v4();
+      await config.ec2.authorizeSecurityGroupIngress({
+        GroupId: group.GroupId,
+        IpPermissions: [{
+          IpProtocol: 'tcp', 
+          FromPort: config.port, 
+          ToPort: config.port,
+          IpRanges: [{
+            CidrIp: `${myPublicIp}/32`, 
+            Description: config.description,
+          }], 
+        }] 
+      }).promise();
+
+      console.log(`The IP ${myPublicIp} is added`);
+    }
+
+  } catch (error) {
+    core.setFailed(error.message);
+  }
+}
+
+run();