From 1c7fa0bc9e713c75a3f6e97623deadbc4105cf55 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Mon, 26 Jan 2026 16:13:56 +0000 Subject: [PATCH 01/13] removing unused ckan infra --- infrastructure/blocks/ecr/main.tf | 68 --------------------------- infrastructure/blocks/ecr/outputs.tf | 10 ---- infrastructure/blocks/pipeline/iam.tf | 6 +-- 3 files changed, 2 insertions(+), 82 deletions(-) diff --git a/infrastructure/blocks/ecr/main.tf b/infrastructure/blocks/ecr/main.tf index 15ebdf81..8e29705c 100644 --- a/infrastructure/blocks/ecr/main.tf +++ b/infrastructure/blocks/ecr/main.tf @@ -55,58 +55,6 @@ resource "aws_ecr_lifecycle_policy" "image_expiry_policies" { EOF } - -resource "aws_ecr_repository" "private_ckan" { - #checkov:skip=CKV_AWS_51:No need for immutable tags - name = "rapid-ckan" - image_tag_mutability = "MUTABLE" - tags = var.tags - - image_scanning_configuration { - scan_on_push = true - } - - encryption_configuration { - encryption_type = "KMS" - } -} - -resource "aws_ecr_lifecycle_policy" "image_expiry_policies_ckan" { - repository = aws_ecr_repository.private_ckan.name - - policy = < Date: Mon, 26 Jan 2026 16:21:23 +0000 Subject: [PATCH 02/13] updating deprecated code in pipeline --- infrastructure/blocks/pipeline/main.tf | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/infrastructure/blocks/pipeline/main.tf b/infrastructure/blocks/pipeline/main.tf index 7dc9d931..8e3bcc7c 100644 --- a/infrastructure/blocks/pipeline/main.tf +++ b/infrastructure/blocks/pipeline/main.tf @@ -5,9 +5,11 @@ resource "aws_instance" "pipeline" { associate_public_ip_address = false iam_instance_profile = aws_iam_instance_profile.pipeline_instance_profile.name subnet_id = data.terraform_remote_state.vpc-state.outputs.private_subnets_ids[0] - user_data = data.template_file.initialise-runner.rendered - monitoring = true - vpc_security_group_ids = [aws_security_group.this.id] + user_data = templatefile("${path.module}/initialisation-script.sh.tpl", { + runner-registration-token = var.runner-registration-token + }) + monitoring = true + vpc_security_group_ids = [aws_security_group.this.id] metadata_options { http_endpoint = "enabled" @@ -32,13 +34,6 @@ resource "aws_iam_instance_profile" "pipeline_instance_profile" { role = aws_iam_role.pipeline_ecr_role.name } -data "template_file" "initialise-runner" { - template = file("${path.module}/initialisation-script.sh.tpl") - vars = { - runner-registration-token = var.runner-registration-token - } -} - resource "aws_security_group" "this" { vpc_id = data.terraform_remote_state.vpc-state.outputs.vpc_id name = "${var.resource-name-prefix}-pipeline-sg" From 56142ccd7a5dfa77f5befcdcfbd2f0ee329e094c Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Mon, 26 Jan 2026 16:59:22 +0000 Subject: [PATCH 03/13] removing pipeline infrastructure --- infrastructure/blocks/pipeline-ami/data.tf | 9 - infrastructure/blocks/pipeline-ami/install.sh | 38 --- infrastructure/blocks/pipeline-ami/packer.tf | 25 -- .../blocks/pipeline-ami/provider.tf | 5 - .../blocks/pipeline-ami/template.json | 54 ---- .../blocks/pipeline-ami/variables.tf | 33 --- infrastructure/blocks/pipeline/data.tf | 55 ---- infrastructure/blocks/pipeline/iam.tf | 262 ------------------ .../pipeline/initialisation-script.sh.tpl | 20 -- infrastructure/blocks/pipeline/main.tf | 51 ---- infrastructure/blocks/pipeline/outputs.tf | 4 - infrastructure/blocks/pipeline/provider.tf | 5 - infrastructure/blocks/pipeline/variables.tf | 34 --- infrastructure/blocks/pipeline/versions.tf | 9 - 14 files changed, 604 deletions(-) delete mode 100644 infrastructure/blocks/pipeline-ami/data.tf delete mode 100644 infrastructure/blocks/pipeline-ami/install.sh delete mode 100644 infrastructure/blocks/pipeline-ami/packer.tf delete mode 100644 infrastructure/blocks/pipeline-ami/provider.tf delete mode 100644 infrastructure/blocks/pipeline-ami/template.json delete mode 100644 infrastructure/blocks/pipeline-ami/variables.tf delete mode 100644 infrastructure/blocks/pipeline/data.tf delete mode 100644 infrastructure/blocks/pipeline/iam.tf delete mode 100644 infrastructure/blocks/pipeline/initialisation-script.sh.tpl delete mode 100644 infrastructure/blocks/pipeline/main.tf delete mode 100644 infrastructure/blocks/pipeline/outputs.tf delete mode 100644 infrastructure/blocks/pipeline/provider.tf delete mode 100644 infrastructure/blocks/pipeline/variables.tf delete mode 100644 infrastructure/blocks/pipeline/versions.tf diff --git a/infrastructure/blocks/pipeline-ami/data.tf b/infrastructure/blocks/pipeline-ami/data.tf deleted file mode 100644 index 603ec83b..00000000 --- a/infrastructure/blocks/pipeline-ami/data.tf +++ /dev/null @@ -1,9 +0,0 @@ -data "terraform_remote_state" "vpc-state" { - backend = "s3" - workspace = "prod" - - config = { - key = "vpc/terraform.tfstate" - bucket = var.state_bucket - } -} diff --git a/infrastructure/blocks/pipeline-ami/install.sh b/infrastructure/blocks/pipeline-ami/install.sh deleted file mode 100644 index 020b8edf..00000000 --- a/infrastructure/blocks/pipeline-ami/install.sh +++ /dev/null @@ -1,38 +0,0 @@ -# Enable SSM -sudo snap install amazon-ssm-agent --classic -sudo snap start amazon-ssm-agent - -# Update base packages -sudo apt update -y -sudo dpkg --configure -a - -# Install make -sudo apt-get -y install make - -# Install Java -sudo apt-get install default-jre -y - -# Install jq -sudo apt-get install jq -y - -# Install Docker -sudo apt-get install docker.io -y - -# Install zip -sudo apt-get install zip -y - -# Install unzip -sudo apt-get install unzip -y - -# Install GitHub cli (gh) -type -p curl >/dev/null || sudo apt install curl -y -curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg -sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg -echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null -sudo apt update -sudo apt install gh -y - -# Install V2 AWS CLI -curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" -unzip awscliv2.zip -sudo ./aws/install diff --git a/infrastructure/blocks/pipeline-ami/packer.tf b/infrastructure/blocks/pipeline-ami/packer.tf deleted file mode 100644 index 3b246320..00000000 --- a/infrastructure/blocks/pipeline-ami/packer.tf +++ /dev/null @@ -1,25 +0,0 @@ -resource "null_resource" "packer_build" { - triggers = { - sha256_ami_config = filesha256("${path.module}/template.json") - sha256_ami_install = filesha256("${path.module}/install.sh") - version = var.pipeline_ami_version - } - - provisioner "local-exec" { - command = < Date: Mon, 26 Jan 2026 17:00:05 +0000 Subject: [PATCH 04/13] updating s3 deprecated code --- infrastructure/blocks/s3/main.tf | 50 ++++++++++++++++++++------------ 1 file changed, 32 insertions(+), 18 deletions(-) diff --git a/infrastructure/blocks/s3/main.tf b/infrastructure/blocks/s3/main.tf index 14cd430b..46b7dd59 100644 --- a/infrastructure/blocks/s3/main.tf +++ b/infrastructure/blocks/s3/main.tf @@ -13,23 +13,34 @@ resource "aws_s3_bucket" "rapid_data_storage" { force_destroy = false tags = var.tags - server_side_encryption_configuration { - rule { - apply_server_side_encryption_by_default { - kms_master_key_id = "" # use default - sse_algorithm = "AES256" - } +} + +resource "aws_s3_bucket_server_side_encryption_configuration" "rapid_data_storage" { + bucket = aws_s3_bucket.rapid_data_storage.id + + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = "" # use default + sse_algorithm = "AES256" } } - versioning { - enabled = true - } - logging { - target_bucket = aws_s3_bucket.logs.bucket - target_prefix = "log/${var.data_bucket_name}" +} + +resource "aws_s3_bucket_versioning" "rapid_data_storage" { + bucket = aws_s3_bucket.rapid_data_storage.id + + versioning_configuration { + status = "Enabled" } } +resource "aws_s3_bucket_logging" "rapid_data_storage" { + bucket = aws_s3_bucket.rapid_data_storage.id + + target_bucket = aws_s3_bucket.logs.bucket + target_prefix = "log/${var.data_bucket_name}" +} + resource "aws_s3_bucket_ownership_controls" "rapid_data_storage" { bucket = aws_s3_bucket.rapid_data_storage.id @@ -69,12 +80,15 @@ resource "aws_s3_bucket" "logs" { force_destroy = false tags = var.tags - server_side_encryption_configuration { - rule { - apply_server_side_encryption_by_default { - kms_master_key_id = "" # use default - sse_algorithm = "AES256" - } +} + +resource "aws_s3_bucket_server_side_encryption_configuration" "logs" { + bucket = aws_s3_bucket.logs.id + + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = "" # use default + sse_algorithm = "AES256" } } } From 6601cdfa56404d2c68dbca09ad7b922e2fb0d9b9 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Mon, 26 Jan 2026 17:41:45 +0000 Subject: [PATCH 05/13] reducing permissions on IAM role --- .../modules/aws-core/iam-resources/iam.tf | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/infrastructure/modules/aws-core/iam-resources/iam.tf b/infrastructure/modules/aws-core/iam-resources/iam.tf index 9e23136f..2eef5e61 100644 --- a/infrastructure/modules/aws-core/iam-resources/iam.tf +++ b/infrastructure/modules/aws-core/iam-resources/iam.tf @@ -84,10 +84,27 @@ data "aws_iam_policy_document" "user_access_policy_document" { "iam:PassRole", ] - not_resources = [ - aws_iam_role.user_access_role.arn, - aws_iam_role.admin_access_role.arn + resources = [ + "arn:aws:iam::${local.users_account_id}:role/*-ecs-*", + "arn:aws:iam::${local.users_account_id}:role/*-lambda-*", + "arn:aws:iam::${local.users_account_id}:role/*-cloudfront-*", + "arn:aws:iam::${local.users_account_id}:role/*-config-*", + "arn:aws:iam::${local.users_account_id}:role/*-cloudtrail-*", + "arn:aws:iam::${local.users_account_id}:role/*-logs-*", ] + + condition { + test = "StringEquals" + variable = "iam:PassedToService" + values = [ + "ecs-tasks.amazonaws.com", + "lambda.amazonaws.com", + "edgelambda.amazonaws.com", + "config.amazonaws.com", + "cloudtrail.amazonaws.com", + "logs.amazonaws.com", + ] + } } } From 84ed4fe3825abda76e116acac3a574212c6a8db7 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Tue, 27 Jan 2026 11:00:15 +0000 Subject: [PATCH 06/13] new ecr container scanning --- infrastructure/blocks/ecr/main.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/infrastructure/blocks/ecr/main.tf b/infrastructure/blocks/ecr/main.tf index 8e29705c..e62fb604 100644 --- a/infrastructure/blocks/ecr/main.tf +++ b/infrastructure/blocks/ecr/main.tf @@ -12,6 +12,7 @@ resource "aws_ecr_repository" "private" { image_scanning_configuration { scan_on_push = true + scan_type = "BASIC" } encryption_configuration { From c0f8db7e5c4de6864890b66f353701a660bbfc27 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Tue, 27 Jan 2026 11:30:21 +0000 Subject: [PATCH 07/13] removing iam inline policies in use --- .../modules/aws-core/iam-users/iam.tf | 28 ++++++++++++------- infrastructure/modules/ui/lambda.tf | 13 ++++++--- 2 files changed, 27 insertions(+), 14 deletions(-) diff --git a/infrastructure/modules/aws-core/iam-users/iam.tf b/infrastructure/modules/aws-core/iam-users/iam.tf index 68d19ae5..6807d3a3 100644 --- a/infrastructure/modules/aws-core/iam-users/iam.tf +++ b/infrastructure/modules/aws-core/iam-users/iam.tf @@ -205,12 +205,16 @@ data "aws_iam_policy_document" "assume_role_admin_access_group_policy_document" } } -resource "aws_iam_group_policy" "assume_role_admin_access_group_policy" { - for_each = toset(local.admin_groups) - name = "admin_access_group_policy" - group = aws_iam_group.groups[each.key].id +resource "aws_iam_policy" "admin_access_group_policy" { + name = "admin_access_group_policy" + description = "Managed policy for admin group to assume admin role" + policy = data.aws_iam_policy_document.assume_role_admin_access_group_policy_document.json +} - policy = data.aws_iam_policy_document.assume_role_admin_access_group_policy_document.json +resource "aws_iam_group_policy_attachment" "assume_role_admin_access_group_policy_attachment" { + for_each = toset(local.admin_groups) + group = aws_iam_group.groups[each.key].id + policy_arn = aws_iam_policy.admin_access_group_policy.arn } data "aws_iam_policy_document" "assume_role_users_access_group_policy_document" { @@ -227,10 +231,14 @@ data "aws_iam_policy_document" "assume_role_users_access_group_policy_document" } } -resource "aws_iam_group_policy" "assume_role_users_access_group_policy" { - for_each = toset(local.user_groups) - name = "users_access_group_policy" - group = aws_iam_group.groups[each.key].id +resource "aws_iam_policy" "users_access_group_policy" { + name = "users_access_group_policy" + description = "Managed policy for users group to assume user role" + policy = data.aws_iam_policy_document.assume_role_users_access_group_policy_document.json +} - policy = data.aws_iam_policy_document.assume_role_users_access_group_policy_document.json +resource "aws_iam_group_policy_attachment" "assume_role_users_access_group_policy_attachment" { + for_each = toset(local.user_groups) + group = aws_iam_group.groups[each.key].id + policy_arn = aws_iam_policy.users_access_group_policy.arn } diff --git a/infrastructure/modules/ui/lambda.tf b/infrastructure/modules/ui/lambda.tf index 9dac1505..f3ed5ee0 100644 --- a/infrastructure/modules/ui/lambda.tf +++ b/infrastructure/modules/ui/lambda.tf @@ -29,10 +29,15 @@ data "aws_iam_policy_document" "this" { } } -resource "aws_iam_role_policy" "github_runner_lambda" { - name = "${var.resource-name-prefix}-cloudfront-router-policy" - role = aws_iam_role.this.name - policy = data.aws_iam_policy_document.this.json +resource "aws_iam_policy" "cloudfront_router_policy" { + name = "${var.resource-name-prefix}-cloudfront-router-policy" + description = "Managed policy for CloudFront Lambda@Edge router logging" + policy = data.aws_iam_policy_document.this.json +} + +resource "aws_iam_role_policy_attachment" "cloudfront_router_policy_attachment" { + role = aws_iam_role.this.name + policy_arn = aws_iam_policy.cloudfront_router_policy.arn } resource "aws_lambda_function" "this" { From 3e92b52135c04f7e177f8842faf6fef0a9bacb2d Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Tue, 27 Jan 2026 15:55:43 +0000 Subject: [PATCH 08/13] adding s3 encryption policies --- infrastructure/blocks/s3/main.tf | 48 +++++++++++++++++++ .../modules/app-cluster/load_balancer.tf | 1 - 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/infrastructure/blocks/s3/main.tf b/infrastructure/blocks/s3/main.tf index 46b7dd59..97af25dd 100644 --- a/infrastructure/blocks/s3/main.tf +++ b/infrastructure/blocks/s3/main.tf @@ -114,3 +114,51 @@ resource "aws_s3_bucket_public_access_block" "logs" { block_public_policy = true restrict_public_buckets = true } + +resource "aws_s3_bucket_policy" "rapid_data_storage_secure_transport" { + bucket = aws_s3_bucket.rapid_data_storage.id + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Sid = "AllowSSLRequestsOnly" + Effect = "Deny" + Principal = "*" + Action = "s3:*" + Resource = [ + aws_s3_bucket.rapid_data_storage.arn, + "${aws_s3_bucket.rapid_data_storage.arn}/*" + ] + Condition = { + Bool = { + "aws:SecureTransport" = "false" + } + } + } + ] + }) +} + +resource "aws_s3_bucket_policy" "logs_secure_transport" { + bucket = aws_s3_bucket.logs.id + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Sid = "AllowSSLRequestsOnly" + Effect = "Deny" + Principal = "*" + Action = "s3:*" + Resource = [ + aws_s3_bucket.logs.arn, + "${aws_s3_bucket.logs.arn}/*" + ] + Condition = { + Bool = { + "aws:SecureTransport" = "false" + } + } + } + ] + }) +} diff --git a/infrastructure/modules/app-cluster/load_balancer.tf b/infrastructure/modules/app-cluster/load_balancer.tf index 8ff15435..024bcb06 100644 --- a/infrastructure/modules/app-cluster/load_balancer.tf +++ b/infrastructure/modules/app-cluster/load_balancer.tf @@ -1,5 +1,4 @@ resource "aws_alb" "application_load_balancer" { - #checkov:skip=CKV_AWS_150:No need for deletion protection #checkov:skip=CKV2_AWS_28:No need for load balancer waf name = "${var.resource-name-prefix}-alb" internal = false From 70e1a806231acd2e3379d323946bfcb90fd51053 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Tue, 27 Jan 2026 17:01:20 +0000 Subject: [PATCH 09/13] fixing ecr scanning --- infrastructure/blocks/ecr/main.tf | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/infrastructure/blocks/ecr/main.tf b/infrastructure/blocks/ecr/main.tf index e62fb604..00f963e5 100644 --- a/infrastructure/blocks/ecr/main.tf +++ b/infrastructure/blocks/ecr/main.tf @@ -4,6 +4,18 @@ terraform { } } +resource "aws_ecr_registry_scanning_configuration" "this" { + scan_type = "BASIC" + + rule { + scan_frequency = "SCAN_ON_PUSH" + repository_filter { + filter = "*" + filter_type = "WILDCARD" + } + } +} + resource "aws_ecr_repository" "private" { #checkov:skip=CKV_AWS_51:No need for immutable tags name = "data-f1-registry" @@ -12,7 +24,6 @@ resource "aws_ecr_repository" "private" { image_scanning_configuration { scan_on_push = true - scan_type = "BASIC" } encryption_configuration { From 23c0ba935e2584212a4b9ce35996205215a04a14 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Wed, 28 Jan 2026 15:09:05 +0000 Subject: [PATCH 10/13] make pass role less permissive --- infrastructure/modules/aws-core/iam-resources/iam.tf | 8 -------- 1 file changed, 8 deletions(-) diff --git a/infrastructure/modules/aws-core/iam-resources/iam.tf b/infrastructure/modules/aws-core/iam-resources/iam.tf index 2eef5e61..560c92b1 100644 --- a/infrastructure/modules/aws-core/iam-resources/iam.tf +++ b/infrastructure/modules/aws-core/iam-resources/iam.tf @@ -87,10 +87,6 @@ data "aws_iam_policy_document" "user_access_policy_document" { resources = [ "arn:aws:iam::${local.users_account_id}:role/*-ecs-*", "arn:aws:iam::${local.users_account_id}:role/*-lambda-*", - "arn:aws:iam::${local.users_account_id}:role/*-cloudfront-*", - "arn:aws:iam::${local.users_account_id}:role/*-config-*", - "arn:aws:iam::${local.users_account_id}:role/*-cloudtrail-*", - "arn:aws:iam::${local.users_account_id}:role/*-logs-*", ] condition { @@ -99,10 +95,6 @@ data "aws_iam_policy_document" "user_access_policy_document" { values = [ "ecs-tasks.amazonaws.com", "lambda.amazonaws.com", - "edgelambda.amazonaws.com", - "config.amazonaws.com", - "cloudtrail.amazonaws.com", - "logs.amazonaws.com", ] } } From 95cc667b71db35ed5dd8f60b538b0597e9139c11 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Fri, 30 Jan 2026 09:46:41 +0000 Subject: [PATCH 11/13] remove aws-core and optional iam setup --- docs/infrastructure/deployment.md | 55 +- infrastructure/blocks/iam-config/main.tf | 41 -- infrastructure/blocks/iam-config/output.tf | 19 - infrastructure/blocks/iam-config/variables.tf | 47 -- infrastructure/blocks/iam-config/versions.tf | 9 - infrastructure/modules/aws-core/README.md | Bin 383 -> 0 bytes .../modules/aws-core/config/main.tf | 539 ------------------ .../modules/aws-core/config/outputs.tf | 4 - .../modules/aws-core/config/variables.tf | 99 ---- .../modules/aws-core/config/versions.tf | 3 - .../modules/aws-core/iam-resources/iam.tf | 213 ------- .../modules/aws-core/iam-resources/outputs.tf | 19 - .../aws-core/iam-resources/variables.tf | 55 -- .../aws-core/iam-resources/versions.tf | 4 - .../modules/aws-core/iam-users/iam.tf | 244 -------- .../modules/aws-core/iam-users/outputs.tf | 9 - .../modules/aws-core/iam-users/variables.tf | 88 --- .../modules/aws-core/iam-users/versions.tf | 4 - 18 files changed, 7 insertions(+), 1445 deletions(-) delete mode 100644 infrastructure/blocks/iam-config/main.tf delete mode 100644 infrastructure/blocks/iam-config/output.tf delete mode 100644 infrastructure/blocks/iam-config/variables.tf delete mode 100644 infrastructure/blocks/iam-config/versions.tf delete mode 100644 infrastructure/modules/aws-core/README.md delete mode 100644 infrastructure/modules/aws-core/config/main.tf delete mode 100644 infrastructure/modules/aws-core/config/outputs.tf delete mode 100644 infrastructure/modules/aws-core/config/variables.tf delete mode 100644 infrastructure/modules/aws-core/config/versions.tf delete mode 100644 infrastructure/modules/aws-core/iam-resources/iam.tf delete mode 100644 infrastructure/modules/aws-core/iam-resources/outputs.tf delete mode 100644 infrastructure/modules/aws-core/iam-resources/variables.tf delete mode 100644 infrastructure/modules/aws-core/iam-resources/versions.tf delete mode 100644 infrastructure/modules/aws-core/iam-users/iam.tf delete mode 100644 infrastructure/modules/aws-core/iam-users/outputs.tf delete mode 100644 infrastructure/modules/aws-core/iam-users/variables.tf delete mode 100644 infrastructure/modules/aws-core/iam-users/versions.tf diff --git a/docs/infrastructure/deployment.md b/docs/infrastructure/deployment.md index ef9d6882..b3b45a20 100644 --- a/docs/infrastructure/deployment.md +++ b/docs/infrastructure/deployment.md @@ -88,7 +88,6 @@ There are two config files needed to instantiate the rAPId service, they are `in state_bucket = "" data_bucket_name = "" log_bucket_name = "" -iam_account_alias = "" application_version = "" ui_version = "" @@ -151,40 +150,7 @@ To set up the S3 backend follow these steps: - Replace the values in `backend.hcl` with your custom values (these can be any value you would like). They will be referenced to create the Terraform state components and used going forwards as the backend config. - In the root folder run `make infra/backend`, this will initialise Terraform by creating both the state bucket and dynamodb table in AWS. -### IAM User Setup (Optional) - -This module is used to set the admin and user roles for the AWS account. It ensures a good level of security by expiring credentials quickly and ensuring that MFA is always needed to refresh them. - -> CAUTION: If you have existing AWS users and don't include them as part of the manual_users, this block will remove them! - -You will need define the desired IAM users (both new and previous manually added -ones) in `input-params.tfvars` and deploy the [iam-config](#deploying-remaining-infra-blocks) block with admin privileges. After that you can use [assume-role](#assume-role) to perform infrastructure changes. - -`infra-params.tfvars` snippet for 'user1': - -``` -set_iam_user_groups = ["users", "admins"] - -iam_users = { - user1 = { - groups = ["users", "admins"] - } -} - -manual_users = { - "user1@domain.email" = { - groups = ["users", "admins"] - } -} -``` - -### Assume role - -In order to gain the admin privileges necessary for infrastructure changes one needs to assume admin role. This will be -enabled only for user's defined in `input-params.tfvars`, only after logging into the AWS console for the first time as an -IAM user and enabling MFA. - -### Deploying remaining infra-blocks +### Deploying infra-blocks Once the state backend has been configured, provide/change the following inputs in `input-params.tfvars`. @@ -193,17 +159,12 @@ Required: - `state_bucket` - The name of the state bucket, as defined in `backend.hcl` - `data_bucket_name` - This will be the bucket where the data is going to be stored, it needs to be a unique name. - `log_bucket_name` - This is the bucket that will be used for logging, it needs to have a unique name. -- `iam_account_alias` - account alias required by AWS, it needs to be a unique name - `application_version` - service's docker image version - `ui_version` - The version of the static frontend site - `domain_name` - application hostname ([can be a domain or a subdomain](./domains_subdomains.md)) - `aws_account` - aws account id where the application will be hosted - `aws_region` - aws region where the application will be hosted -- `iam_users` - IAM users to be created automatically, with roles to be attached to them -- `manual_users` - IAM users that has been already created manually, with roles to be attached. (Can be left empty) -- `set_iam_user_groups` - User groups that need to be present on each user. (i.e. if the value is set to admin, then all - the users will require the admin role) - `support_emails_for_cloudwatch_alerts` - list of engineer emails that should receive alert notifications [more info](./alerting_monitoring.md) - `ip_whitelist` - ip range to add to application whitelist. The expected value is a list of strings. @@ -225,11 +186,9 @@ Then, run the following command on each block: Run the blocks in this order: -1. [iam-config](#iam-user-setup-optional) - > All the users' roles/policies will be handled here and will delete any previous config -2. vpc -3. s3 -4. auth -5. data-workflow -6. app-cluster -7. ui +1. vpc +2. s3 +3. auth +4. data-workflow +5. app-cluster +6. ui diff --git a/infrastructure/blocks/iam-config/main.tf b/infrastructure/blocks/iam-config/main.tf deleted file mode 100644 index 5fef7774..00000000 --- a/infrastructure/blocks/iam-config/main.tf +++ /dev/null @@ -1,41 +0,0 @@ -terraform { - backend "s3" { - key = "iam-config/terraform.tfstate" - } -} - -module "config" { - source = "../../modules/aws-core/config" - - bucket_prefix = var.bucket_prefix - bucket_key_prefix = var.bucket_prefix - enable_lifecycle_management_for_s3 = var.enable_lifecycle_management_for_s3 - password_policy = var.password_policy -} - -module "iam_users" { - source = "../../modules/aws-core/iam-users" - - # This includes some random bits here purely for demonstrational purposes. Please use a distinct unique identifier otherwise! - iam_account_alias = var.iam_account_alias - iam_users = var.iam_users - password_policy = var.password_policy -} - -module "iam_resources" { - source = "../../modules/aws-core/iam-resources" - - # Mandatory parameter so we can't skip it - iam_account_alias = var.iam_account_alias - # This will make sure we're only setting the IAM account alias once, as we're operating in the same account - set_iam_account_alias = false - admin_multi_factor_auth_age = "14400" - admin_max_session_duration = "14400" -} - -resource "aws_iam_user_group_membership" "manual_user_memberships" { - for_each = var.manual_users - user = each.key - - groups = each.value["groups"] -} diff --git a/infrastructure/blocks/iam-config/output.tf b/infrastructure/blocks/iam-config/output.tf deleted file mode 100644 index 5ccb65fe..00000000 --- a/infrastructure/blocks/iam-config/output.tf +++ /dev/null @@ -1,19 +0,0 @@ -output "iam_users" { - value = var.iam_users - description = "The users in the aws account" -} - -output "bucket_prefix" { - value = var.bucket_prefix - description = "The prefix used for all the bucktes" -} - -output "resource_admin_role_arn" { - value = module.iam_resources.resource_admin_role_arn - description = "The arn of the admin role." -} - -output "resource_user_role_arn" { - value = module.iam_resources.resource_user_role_arn - description = "The arn of the user role." -} diff --git a/infrastructure/blocks/iam-config/variables.tf b/infrastructure/blocks/iam-config/variables.tf deleted file mode 100644 index 168fba8f..00000000 --- a/infrastructure/blocks/iam-config/variables.tf +++ /dev/null @@ -1,47 +0,0 @@ -variable "bucket_prefix" { - type = string - description = "The prefix attached to the AWS Config S3 bucket where evaluation results are stored" - # The module default is "aws-config" so you don't necessarily need to specify this - default = "rapid-aws-config-bucket" -} - -variable "iam_account_alias" { - type = string - description = "Unique alias name for the iam account" -} - -variable "enable_lifecycle_management_for_s3" { - type = bool - description = "Whether or not to enable lifecycle management for the created S3 buckets" - # You should set this to true, or just delete the line (the default is "true"), if you're moving this into a production context - default = true -} - -variable "set_iam_user_groups" { - type = list(string) - description = "A list of user groups every user should belong to" -} - -variable "iam_users" { - type = map(map(list(string))) - description = "A list of users you want to create inside the \"users\" account" -} - -variable "manual_users" { - type = map(map(list(string))) - description = "A list of users that were created manually into the account" -} - -variable "password_policy" { - type = object({ - require_uppercase_characters = bool - require_lowercase_characters = bool - require_symbols = bool - require_numbers = bool - minimum_password_length = number - password_reuse_prevention = number - max_password_age = number - allow_users_to_change_password = bool - }) - description = "The password policy for the IAM users" -} diff --git a/infrastructure/blocks/iam-config/versions.tf b/infrastructure/blocks/iam-config/versions.tf deleted file mode 100644 index 28bc5987..00000000 --- a/infrastructure/blocks/iam-config/versions.tf +++ /dev/null @@ -1,9 +0,0 @@ -terraform { - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 4.53.0" - } - } - required_version = ">= 1.3.5" -} diff --git a/infrastructure/modules/aws-core/README.md b/infrastructure/modules/aws-core/README.md deleted file mode 100644 index 579f2a1cf901450f58cea74acceef72d06c1e76a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 383 zcmZvX%L#xm7=yEbI|$z0!-Ef8K|Ki8*5`KONUmV2BKo(KLLvFm 0 ? 1 : 0 - name = "approved_amis_by_tag" - - source { - owner = "AWS" - source_identifier = "APPROVED_AMIS_BY_TAG" - } - - input_parameters = jsonencode({ - amisByTagKeyAndValue = var.amis_by_tag_key_and_value_list - }) - - depends_on = [aws_config_configuration_recorder.config] -} - -resource "aws_config_config_rule" "autoscaling_group_elb_healthcheck_required" { - name = "autoscaling_group_elb_healthcheck_required" - - source { - owner = "AWS" - source_identifier = "AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED" - } - - depends_on = [aws_config_configuration_recorder.config] -} - -resource "aws_config_config_rule" "desired_instance_type" { - count = length(var.desired_instance_types) > 0 ? 1 : 0 - name = "desired_instance_type" - - source { - owner = "AWS" - source_identifier = "DESIRED_INSTANCE_TYPE" - } - - input_parameters = jsonencode({ - InstanceType = var.desired_instance_types - }) - - depends_on = [aws_config_configuration_recorder.config] -} - -resource "aws_config_config_rule" "rds_instance_public_access_check" { - name = "rds_instance_public_access_check" - - source { - owner = "AWS" - source_identifier = "RDS_INSTANCE_PUBLIC_ACCESS_CHECK" - } - - depends_on = [aws_config_configuration_recorder.config] -} - -resource "aws_config_config_rule" "rds_snapshots_public_prohibited" { - name = "rds_snapshots_public_prohibited" - - source { - owner = "AWS" - source_identifier = "RDS_SNAPSHOTS_PUBLIC_PROHIBITED" - } - - depends_on = [aws_config_configuration_recorder.config] -} - -resource "aws_config_config_rule" "iam_policy_no_statements_with_admin_access" { - name = "iam_policy_no_statements_with_admin_access" - - source { - owner = "AWS" - source_identifier = "IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS" - } - - depends_on = [aws_config_configuration_recorder.config] -} - -resource "aws_config_config_rule" "iam_root_access_key_check" { - name = "iam_root_access_key_check" - - source { - owner = "AWS" - source_identifier = "IAM_ROOT_ACCESS_KEY_CHECK" - } - - depends_on = [aws_config_configuration_recorder.config] -} diff --git a/infrastructure/modules/aws-core/config/outputs.tf b/infrastructure/modules/aws-core/config/outputs.tf deleted file mode 100644 index e0a6ea91..00000000 --- a/infrastructure/modules/aws-core/config/outputs.tf +++ /dev/null @@ -1,4 +0,0 @@ -output "config_s3_bucket_id" { - description = "The ID of the S3 bucket AWS Config writes its findings into" - value = var.enable_lifecycle_management_for_s3 ? aws_s3_bucket.config_with_lifecycle[0].id : aws_s3_bucket.config_without_lifecycle[0].id -} diff --git a/infrastructure/modules/aws-core/config/variables.tf b/infrastructure/modules/aws-core/config/variables.tf deleted file mode 100644 index 68229584..00000000 --- a/infrastructure/modules/aws-core/config/variables.tf +++ /dev/null @@ -1,99 +0,0 @@ -variable "bucket_prefix" { - type = string - description = "The prefix for the S3 bucket AWS Config Recorder writes to" - default = "aws-config" -} - -variable "bucket_key_prefix" { - type = string - description = "The prefix of the keys AWS Config writes to" - default = "aws_config" -} - -variable "config_recorder_name" { - type = string - description = "The name of the recorder for AWS Config" - default = "config" -} - -variable "config_delivery_channel_name" { - type = string - description = "The name of the delivery channel for AWS Config" - default = "config" -} - -variable "iam_role_name" { - type = string - description = "The name of the IAM role created for delegating permissions to AWS Config" - default = "config" -} - -variable "bucket_account_id" { - type = string - description = "The AWS account ID the S3 bucket lives in that AWS Config is writing its records to. Defaults to the ID of the current account" - default = "" -} - -variable "delivery_frequency" { - type = string - description = "The frequency at which AWS Config delivers its recorded findings to S3" - default = "Three_Hours" -} - -variable "password_policy" { - type = map(string) - description = "A map of values describing the password policy parameters AWS Config is looking for" - default = {} -} - -variable "iam_user_groups" { - type = map(string) - description = "A list of mandatory groups for IAM users" - default = {} -} - -variable "max_access_key_age" { - type = string - description = "The maximum amount of days an access key can live without being rotated" - default = "90" -} - -variable "enable_lifecycle_management_for_s3" { - type = bool - description = "Whether or not to enable lifecycle management for the S3 bucket AWS Config writes to" - default = true -} - -variable "amis_by_tag_key_and_value_list" { - type = list(string) - description = "Required AMI tags for EC2 instances" - default = [] -} - -variable "desired_instance_types" { - type = set(string) - description = "A string of comma-delimited instance types" - default = [] -} - -variable "s3_kms_sse_encryption_key_arn" { - type = string - description = "The ARN for the KMS key to use for S3 server-side bucket encryption" - default = "" # Use the default master key -} - -locals { - config_policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole" - bucket_account_id = length(var.bucket_account_id) > 0 ? var.bucket_account_id : data.aws_caller_identity.current.account_id - password_policy = merge({ - require_uppercase_characters = true - require_lowercase_characters = true - require_symbols = true - require_numbers = true - minimum_password_length = 32 - password_reuse_prevention = 5 - max_password_age = 90 - }, var.password_policy) -} - -data "aws_caller_identity" "current" {} diff --git a/infrastructure/modules/aws-core/config/versions.tf b/infrastructure/modules/aws-core/config/versions.tf deleted file mode 100644 index c24371c1..00000000 --- a/infrastructure/modules/aws-core/config/versions.tf +++ /dev/null @@ -1,3 +0,0 @@ -terraform { - required_version = ">= 1.3.5" -} diff --git a/infrastructure/modules/aws-core/iam-resources/iam.tf b/infrastructure/modules/aws-core/iam-resources/iam.tf deleted file mode 100644 index 560c92b1..00000000 --- a/infrastructure/modules/aws-core/iam-resources/iam.tf +++ /dev/null @@ -1,213 +0,0 @@ -resource "aws_iam_account_alias" "iam_account_alias" { - count = var.set_iam_account_alias ? 1 : 0 - account_alias = var.iam_account_alias -} - -# Roles -data "aws_iam_policy_document" "admin_access_role_policy" { - statement { - effect = "Allow" - - actions = [ - "sts:AssumeRole", - ] - - condition { - test = "Bool" - variable = "aws:MultiFactorAuthPresent" - values = ["true"] - } - - condition { - test = "NumericLessThan" - variable = "aws:MultiFactorAuthAge" - values = [var.admin_multi_factor_auth_age] - } - - principals { - type = "AWS" - - identifiers = [ - "arn:aws:iam::${local.users_account_id}:root", - ] - } - } -} - -resource "aws_iam_role" "admin_access_role" { - name = var.admin_access_role_name - max_session_duration = var.admin_max_session_duration - assume_role_policy = data.aws_iam_policy_document.admin_access_role_policy.json -} - -data "aws_iam_policy_document" "user_access_role_policy" { - statement { - effect = "Allow" - - actions = [ - "sts:AssumeRole", - ] - - condition { - test = "Bool" - variable = "aws:MultiFactorAuthPresent" - values = ["true"] - } - - condition { - test = "NumericLessThan" - variable = "aws:MultiFactorAuthAge" - values = [var.user_multi_factor_auth_age] - } - - principals { - type = "AWS" - - identifiers = [ - "arn:aws:iam::${local.users_account_id}:root", - ] - } - } -} - -resource "aws_iam_role" "user_access_role" { - name = var.user_access_role_name - - assume_role_policy = data.aws_iam_policy_document.user_access_role_policy.json -} - -data "aws_iam_policy_document" "user_access_policy_document" { - statement { - effect = "Allow" - - actions = [ - "iam:PassRole", - ] - - resources = [ - "arn:aws:iam::${local.users_account_id}:role/*-ecs-*", - "arn:aws:iam::${local.users_account_id}:role/*-lambda-*", - ] - - condition { - test = "StringEquals" - variable = "iam:PassedToService" - values = [ - "ecs-tasks.amazonaws.com", - "lambda.amazonaws.com", - ] - } - } -} - -resource "aws_iam_policy" "user_access_policy" { - name = "user_access_policy" - description = "User access for roles" - - policy = data.aws_iam_policy_document.user_access_policy_document.json -} - -data "aws_iam_policy_document" "no_vpc_access_policy_document" { - statement { - effect = "Deny" - - actions = [ - "ec2:AcceptVpcPeeringConnection", - "ec2:AssociateDhcpOptions", - "ec2:AssociateRouteTable", - "ec2:AttachClassicLinkVpc", - "ec2:AttachInternetGateway", - "ec2:AttachVpnGateway", - "ec2:CreateCustomerGateway", - "ec2:CreateDhcpOptions", - "ec2:CreateFlowLogs", - "ec2:CreateInternetGateway", - "ec2:CreateNatGateway", - "ec2:CreateNetworkAcl", - "ec2:CreateNetworkAclEntry", - "ec2:CreateRoute", - "ec2:CreateRouteTable", - "ec2:CreateSubnet", - "ec2:CreateVpc", - "ec2:CreateVpcPeeringConnection", - "ec2:CreateVpnConnection", - "ec2:CreateVpnConnectionRoute", - "ec2:CreateVpnGateway", - "ec2:DeleteCustomerGateway", - "ec2:DeleteDhcpOptions", - "ec2:DeleteInternetGateway", - "ec2:DeleteNatGateway", - "ec2:DeleteNetworkAcl", - "ec2:DeleteNetworkAclEntry", - "ec2:DeleteRoute", - "ec2:DeleteRouteTable", - "ec2:DeleteSubnet", - "ec2:DeleteVpc", - "ec2:DeleteVpnConnection", - "ec2:DeleteVpnConnectionRoute", - "ec2:DeleteVpnGateway", - "ec2:DetachClassicLinkVpc", - "ec2:DetachInternetGateway", - "ec2:DetachVpnGateway", - "ec2:DisableVgwRoutePropagation", - "ec2:DisableVpcClassicLink", - "ec2:DisableVpcClassicLinkDnsSupport", - "ec2:DisassociateRouteTable", - "ec2:EnableVgwRoutePropagation", - "ec2:EnableVpcClassicLink", - "ec2:EnableVpcClassicLinkDnsSupport", - "ec2:ModifySubnetAttribute", - "ec2:ModifyVpcAttribute", - "ec2:ModifyVpcEndpoint", - "ec2:ModifyVpcPeeringConnectionOptions", - "ec2:MoveAddressToVpc", - "ec2:RejectVpcPeeringConnection", - "ec2:ReplaceNetworkAclAssociation", - "ec2:ReplaceNetworkAclEntry", - "ec2:ReplaceRoute", - "ec2:ReplaceRouteTableAssociation", - "ec2:RestoreAddressToClassic", - ] - - resources = ["*"] - } -} - -resource "aws_iam_policy" "user_no_vpc_access_policy" { - name = "user_no_vpc_access_policy" - description = "deny user access to VPC related commands" - - policy = data.aws_iam_policy_document.no_vpc_access_policy_document.json -} - -# Policy attachments for roles -resource "aws_iam_policy_attachment" "admin_access_policy_attachment" { - # checkov:skip=CKV_AWS_274: Allow for AWS Administator Access - name = "admin_access_policy_attachment" - roles = [aws_iam_role.admin_access_role.name] - policy_arn = local.administrator_access_policy_arn -} - -resource "aws_iam_policy_attachment" "user_access_policy_attachment" { - name = "user_access_policy_attachment" - roles = [aws_iam_role.user_access_role.name] - policy_arn = aws_iam_policy.user_access_policy.arn -} - -resource "aws_iam_policy_attachment" "user_access_no_vpc_access_policy_attachment" { - name = "user_access_no_vpc_access_policy_attachment" - roles = [aws_iam_role.user_access_role.name] - policy_arn = aws_iam_policy.user_no_vpc_access_policy.arn -} - -resource "aws_iam_policy_attachment" "user_access_iam_read_only_policy_attachment" { - name = "user_access_iam_read_only_policy_attachment" - roles = [aws_iam_role.user_access_role.name] - policy_arn = local.iam_read_only_access_policy_arn -} - -resource "aws_iam_policy_attachment" "user_access_power_user_policy_attachment" { - name = "user_access_power_user_policy_attachment" - roles = [aws_iam_role.user_access_role.name] - policy_arn = local.power_user_access_policy_arn -} diff --git a/infrastructure/modules/aws-core/iam-resources/outputs.tf b/infrastructure/modules/aws-core/iam-resources/outputs.tf deleted file mode 100644 index 3da8433b..00000000 --- a/infrastructure/modules/aws-core/iam-resources/outputs.tf +++ /dev/null @@ -1,19 +0,0 @@ -output "resource_admin_role_name" { - value = aws_iam_role.admin_access_role.name - description = "The name of the role users are able to assume to attain admin privileges" -} - -output "resource_admin_role_arn" { - value = aws_iam_role.admin_access_role.arn - description = "The ARN of the role users are able to assume to attain admin privileges" -} - -output "resource_user_role_name" { - value = aws_iam_role.user_access_role.name - description = "The name of the role users are able to assume to attain user privileges" -} - -output "resource_user_role_arn" { - value = aws_iam_role.user_access_role.arn - description = "The ARN of the role users are able to assume to attain user privileges" -} diff --git a/infrastructure/modules/aws-core/iam-resources/variables.tf b/infrastructure/modules/aws-core/iam-resources/variables.tf deleted file mode 100644 index dc3f269c..00000000 --- a/infrastructure/modules/aws-core/iam-resources/variables.tf +++ /dev/null @@ -1,55 +0,0 @@ -variable "iam_account_alias" { - type = string - description = "A globally unique identifier, human-readable for your AWS account" -} - -variable "users_account_id" { - type = string - description = "The account ID of where the users are living in" - default = "" -} - -variable "set_iam_account_alias" { - type = bool - description = "Whether or not to set the account alias (useful to set to false when iam-users and iam-resources module are being deployed into the same account)" - default = true -} - -variable "admin_multi_factor_auth_age" { - type = string - description = "The amount of time (in seconds) for a admin session to be valid" - default = "3600" -} - -variable "user_multi_factor_auth_age" { - type = string - description = "The amount of time (in seconds) for a user session to be valid" - default = "14400" -} - -variable "admin_access_role_name" { - type = string - description = "Name of the admin role" - default = "resource-admin" -} - -variable "user_access_role_name" { - type = string - description = "Name of the user role" - default = "resource-user" -} - -variable "admin_max_session_duration" { - type = string - description = "The maximum session duration for the admin role" - default = "3600" -} - -data "aws_caller_identity" "current" {} - -locals { - administrator_access_policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess" - iam_read_only_access_policy_arn = "arn:aws:iam::aws:policy/IAMReadOnlyAccess" - power_user_access_policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess" - users_account_id = length(var.users_account_id) > 0 ? var.users_account_id : data.aws_caller_identity.current.account_id -} diff --git a/infrastructure/modules/aws-core/iam-resources/versions.tf b/infrastructure/modules/aws-core/iam-resources/versions.tf deleted file mode 100644 index 1ee80683..00000000 --- a/infrastructure/modules/aws-core/iam-resources/versions.tf +++ /dev/null @@ -1,4 +0,0 @@ - -terraform { - required_version = ">= 1.3.5" -} diff --git a/infrastructure/modules/aws-core/iam-users/iam.tf b/infrastructure/modules/aws-core/iam-users/iam.tf deleted file mode 100644 index 6807d3a3..00000000 --- a/infrastructure/modules/aws-core/iam-users/iam.tf +++ /dev/null @@ -1,244 +0,0 @@ -# This is a policy which lets you self-service your own access keys. -# The only condition is that you have a MFA enabled session -data "aws_iam_policy_document" "aws_access_key_self_service_policy" { - statement { - actions = [ - "iam:CreateAccessKey", - "iam:DeleteAccessKey", - "iam:ListAccessKeys", - "iam:UpdateAccessKey", - ] - - effect = "Allow" - - condition { - test = "Bool" - variable = "aws:MultiFactorAuthPresent" - values = ["true"] - } - - condition { - test = "NumericLessThan" - variable = "aws:MultiFactorAuthAge" - values = [var.multi_factor_auth_age] - } - - resources = [ - "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}", - ] - } -} - -resource "aws_iam_policy" "aws_access_key_self_service" { - name = "aws_access_key_self_service" - description = "Policy for access key self service" - - policy = data.aws_iam_policy_document.aws_access_key_self_service_policy.json -} - -resource "aws_iam_account_password_policy" "strict" { - # checkov:skip=CKV_AWS_9:Let users determine their own password policy - # checkov:skip=CKV_AWS_11:Let users determine their own password policy - # checkov:skip=CKV_AWS_12:Let users determine their own password policy - # checkov:skip=CKV_AWS_13:Let users determine their own password policy - # checkov:skip=CKV_AWS_14:Let users determine their own password policy - # checkov:skip=CKV_AWS_15:Let users determine their own password policy - minimum_password_length = local.password_policy["minimum_password_length"] - max_password_age = local.password_policy["max_password_age"] - password_reuse_prevention = local.password_policy["password_reuse_prevention"] - require_lowercase_characters = local.password_policy["require_lowercase_characters"] - require_numbers = local.password_policy["require_numbers"] - require_uppercase_characters = local.password_policy["require_uppercase_characters"] - require_symbols = local.password_policy["require_symbols"] - allow_users_to_change_password = local.password_policy["allow_users_to_change_password"] -} - -# This allows users without MFA to at least get a few details about their own account -data "aws_iam_policy_document" "aws_list_iam_users_policy" { - statement { - effect = "Allow" - - actions = [ - "iam:GetAccountSummary", - "iam:ListAccountAliases", - "iam:ListGroupsForUser", - "iam:ListUsers", - ] - - resources = [ - "arn:aws:iam::${data.aws_caller_identity.current.account_id}:*", - ] - } - - statement { - actions = ["iam:GetUser"] - - resources = [ - "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}", - ] - - effect = "Allow" - } -} - -resource "aws_iam_policy" "aws_list_iam_users" { - name = "aws_list_iam_users" - description = "Let users see the list of users" - - policy = data.aws_iam_policy_document.aws_list_iam_users_policy.json -} - -data "aws_iam_policy_document" "aws_mfa_self_service_policy" { - statement { - effect = "Allow" - - resources = [ - "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}", - ] - - actions = [ - "iam:DeactivateMFADevice", - "iam:EnableMFADevice", - "iam:ResyncMFADevice", - "iam:ListVirtualMFADevices", - "iam:ListMFADevices", - ] - } - - statement { - effect = "Allow" - - resources = [ - "arn:aws:iam::${data.aws_caller_identity.current.account_id}:mfa/$${aws:username}", - ] - - actions = [ - "iam:CreateVirtualMFADevice", - "iam:DeleteVirtualMFADevice", - ] - } - - statement { - effect = "Allow" - - resources = [ - "arn:aws:iam::${data.aws_caller_identity.current.account_id}:mfa/*", - ] - - actions = [ - "iam:ListVirtualMFADevices", - "iam:ListMFADevices", - ] - } -} - -resource "aws_iam_policy" "aws_mfa_self_service" { - name = "aws_mfa_self_service" - description = "Policy for MFA self service" - - policy = data.aws_iam_policy_document.aws_mfa_self_service_policy.json -} - -resource "aws_iam_account_alias" "iam_account_alias" { - count = var.set_iam_account_alias ? 1 : 0 - account_alias = var.iam_account_alias -} - -# Users -resource "aws_iam_user" "users" { - # checkov:skip=CKV_AWS_273: Allow for iam defined users - for_each = var.iam_users - name = each.key -} - -resource "aws_iam_user_group_membership" "users_group_memberships" { - depends_on = [ - aws_iam_user.users, - aws_iam_group.groups - ] - for_each = var.iam_users - user = each.key - - groups = each.value["groups"] -} - -# Groups -resource "aws_iam_group" "groups" { - for_each = toset(concat( - local.admin_groups, - local.user_groups - )) - name = each.key -} - -# Group policy assignments -resource "aws_iam_policy_attachment" "users_mfa_self_service" { - name = "users_mfa_self_service" - groups = values(aws_iam_group.groups)[*].name - policy_arn = aws_iam_policy.aws_mfa_self_service.arn -} - -resource "aws_iam_policy_attachment" "users_access_key_self_service" { - name = "users_access_key_self_service" - groups = values(aws_iam_group.groups)[*].name - policy_arn = aws_iam_policy.aws_access_key_self_service.arn -} - -resource "aws_iam_policy_attachment" "users_list_iam_users" { - name = "users_list_iam_users" - groups = values(aws_iam_group.groups)[*].name - policy_arn = aws_iam_policy.aws_list_iam_users.arn -} - -# Group policies -data "aws_iam_policy_document" "assume_role_admin_access_group_policy_document" { - statement { - actions = [ - "sts:AssumeRole", - ] - - effect = "Allow" - - resources = [ - "arn:aws:iam::${local.resources_account_id}:role/${var.resource_admin_role_name}", - ] - } -} - -resource "aws_iam_policy" "admin_access_group_policy" { - name = "admin_access_group_policy" - description = "Managed policy for admin group to assume admin role" - policy = data.aws_iam_policy_document.assume_role_admin_access_group_policy_document.json -} - -resource "aws_iam_group_policy_attachment" "assume_role_admin_access_group_policy_attachment" { - for_each = toset(local.admin_groups) - group = aws_iam_group.groups[each.key].id - policy_arn = aws_iam_policy.admin_access_group_policy.arn -} - -data "aws_iam_policy_document" "assume_role_users_access_group_policy_document" { - statement { - effect = "Allow" - - actions = [ - "sts:AssumeRole", - ] - - resources = [ - "arn:aws:iam::${local.resources_account_id}:role/${var.resource_user_role_name}" - ] - } -} - -resource "aws_iam_policy" "users_access_group_policy" { - name = "users_access_group_policy" - description = "Managed policy for users group to assume user role" - policy = data.aws_iam_policy_document.assume_role_users_access_group_policy_document.json -} - -resource "aws_iam_group_policy_attachment" "assume_role_users_access_group_policy_attachment" { - for_each = toset(local.user_groups) - group = aws_iam_group.groups[each.key].id - policy_arn = aws_iam_policy.users_access_group_policy.arn -} diff --git a/infrastructure/modules/aws-core/iam-users/outputs.tf b/infrastructure/modules/aws-core/iam-users/outputs.tf deleted file mode 100644 index ca4088a5..00000000 --- a/infrastructure/modules/aws-core/iam-users/outputs.tf +++ /dev/null @@ -1,9 +0,0 @@ -output "admin_group_names" { - value = values(aws_iam_group.groups)[*].name - description = "The names of the admin groups" -} - -output "user_group_names" { - value = values(aws_iam_group.groups)[*].name - description = "The name of the user groups" -} diff --git a/infrastructure/modules/aws-core/iam-users/variables.tf b/infrastructure/modules/aws-core/iam-users/variables.tf deleted file mode 100644 index d1771a56..00000000 --- a/infrastructure/modules/aws-core/iam-users/variables.tf +++ /dev/null @@ -1,88 +0,0 @@ -variable "iam_account_alias" { - type = string - description = "A globally unique identifier, human-readable for your AWS account" -} - -variable "set_iam_account_alias" { - type = bool - description = "Whether or not to set the account alias (useful to set to false when iam-users and iam-resources module are being deployed into the same account)" - default = true -} - -variable "multi_factor_auth_age" { - type = string - description = "The amount of time (in seconds) for a user session to be valid" - default = "14400" -} - -variable "password_policy" { - type = map(string) - description = "A map of password policy parameters you want to set differently from the defaults" - default = {} -} - -variable "resources_account_id" { - type = string - description = "The account ID of the AWS account you want to start resources in" - default = "" -} - -variable "resource_admin_role_name" { - type = string - description = "The name of the administrator role one is supposed to assume in the resource account" - default = "resource-admin" -} - -variable "resource_user_role_name" { - type = string - description = "The name of the user role one is supposed to assume in the resource account" - default = "resource-user" -} - -variable "admin_group_name" { - type = string - description = "The name of the initial group created for administrators" - default = "admins" -} - -variable "user_group_name" { - type = string - description = "The name of the initial group created for users" - default = "users" -} - -variable "additional_admin_groups" { - type = list(string) - description = "A list of additional groups to create associated with administrative privileges" - default = [] -} - -variable "additional_user_groups" { - type = list(string) - description = "A list of additional groups to create associated with regular users" - default = [] -} - -variable "iam_users" { - type = map(map(list(string))) - description = "A list of maps of users and their groups. Default is to create no users." - default = {} -} - -data "aws_caller_identity" "current" {} - -locals { - resources_account_id = length(var.resources_account_id) > 0 ? var.resources_account_id : data.aws_caller_identity.current.account_id - password_policy = merge({ - require_uppercase_characters = true - require_lowercase_characters = true - require_symbols = true - require_numbers = true - minimum_password_length = 32 - password_reuse_prevention = 5 - max_password_age = 90 - allow_users_to_change_password = true # pragma: allowlist secret - }, var.password_policy) - admin_groups = compact(concat([var.admin_group_name], var.additional_admin_groups)) - user_groups = compact(concat([var.user_group_name], var.additional_user_groups)) -} diff --git a/infrastructure/modules/aws-core/iam-users/versions.tf b/infrastructure/modules/aws-core/iam-users/versions.tf deleted file mode 100644 index f3355dbf..00000000 --- a/infrastructure/modules/aws-core/iam-users/versions.tf +++ /dev/null @@ -1,4 +0,0 @@ - -terraform { - required_version = ">= 1.5" -} From ab1ba8ad528d181c746e7f518aeeb7b0e2cc6186 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Fri, 30 Jan 2026 10:21:21 +0000 Subject: [PATCH 12/13] remove multihost vpc and subnets --- .../modules/multihost-vpc/README.md | Bin 7765 -> 0 bytes infrastructure/modules/multihost-vpc/main.tf | 112 ------------------ .../modules/multihost-vpc/outputs.tf | 19 --- .../modules/multihost-vpc/variables.tf | 54 --------- infrastructure/modules/subnets/README.md | Bin 6761 -> 0 bytes infrastructure/modules/subnets/main.tf | 23 ---- infrastructure/modules/subnets/outputs.tf | 4 - infrastructure/modules/subnets/variables.tf | 76 ------------ infrastructure/modules/subnets/versions.tf | 4 - 9 files changed, 292 deletions(-) delete mode 100644 infrastructure/modules/multihost-vpc/README.md delete mode 100644 infrastructure/modules/multihost-vpc/main.tf delete mode 100644 infrastructure/modules/multihost-vpc/outputs.tf delete mode 100644 infrastructure/modules/multihost-vpc/variables.tf delete mode 100644 infrastructure/modules/subnets/README.md delete mode 100644 infrastructure/modules/subnets/main.tf delete mode 100644 infrastructure/modules/subnets/outputs.tf delete mode 100644 infrastructure/modules/subnets/variables.tf delete mode 100644 infrastructure/modules/subnets/versions.tf diff --git a/infrastructure/modules/multihost-vpc/README.md b/infrastructure/modules/multihost-vpc/README.md deleted file mode 100644 index d04767381d3868f4c23e666a16011f8d265cb985..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7765 zcmds6+in|244ogyKMd>_cY#Q~0DUmp073lXho(Uqv_P6bcgqXdma4VlI&nWO$S36& za?ViHaAqZ0tN1|;1Zy=jB!@gha>?=MPai*j`grILop&$Y$o=Eyu5>f}y2Rg=yLOd( zwD>%C6Hsw&6;*3VC(>Ska^l`W+7KKwBj*lMp1WSy!8?xrTu_wYxWf1@$hvcn%_kkn ziqd)a3*>q5iqv1-ftzOg7g)Q276b%1|3S;4H!4!afu1 zHgcVS*fpMGV595A;v6S`4cf{b!{Tz&74Bh2PR!nOlnRwmE|~%*E6wO5JDt zqL$4(DDp+jIw1p>c=w7|bqod_6Wg5(D@*rnV`WjWxM|c|BrNU!0~MRUn|PCr6)Phm zRAipDj^kU$sR|iKs)-gbvH8cY?K2Km&t_io4i*ng)wIu6impxU>mX|~bC#hl?T2TH zta*$2_&sVQo_YoAQ!3W|`+~zT_MF45`XAdnKE^(FoQ|}YJWgmhd%WyK zS9O@Io5k`1`mqAint6y(h1%mB{=%+C`_g*%Y5Cs3!-SK+>b&%?L*S>ovO7)rS^aQl zuGIPUWdFh%`yhVLfF*lDcD57DdHk` zZ>$2Doi{eTugQ_LTtt$(_Te}5C5|KKDlAiOIkm`b_f<5X!ZVnm7(w*XGkiaDr|`m; znDdK!2YM_$*@sxvK0rKDPDbl%!tKXu7#7V(Jp0r1e#!{J>4>GwdbX*4R|E;uW1jfkD13i zi+=*KvTAKdruM|?cufl(*#O-9BLAD$!cocOI8bm84|L?@ta)D~uaEE#?!P4# z%{)%(;+S>W$@M}8se78x+6>R%k$x3U$`f~BO%iz&KaJi~R2cdBGy0~`inrp59sPwP zxpU^M{4^G|Mfj8&zkwJ~3<_JsSm)Yh2gPH=wuo{%VJPdvgY^FLJV hY-1){-xFDnEKqs!K1R-Fon7M5_gTTy{d%1reF3 0 ? var.public_subnet_cidrs[count.index] : cidrsubnet(var.vpc_cidr_range, var.public_subnet_size, count.index) - availability_zone = data.aws_availability_zones.available.names[count.index] - map_public_ip_on_launch = true - - tags = merge({ - Name = "${local.public_subnet_prefix}_${replace( - data.aws_availability_zones.available.names[count.index], - "-", - "_", - )}" - Scope = "public" }, - var.tags) -} - -# IGW - Internet Gateway -resource "aws_internet_gateway" "core_igw" { - vpc_id = aws_vpc.core.id - - tags = merge({ - Name = "${var.vpc_name}_igw" - }, var.tags) -} - -# EIPs for NAT Gateways -resource "aws_eip" "core_nat_gw_eip" { - count = length(data.aws_availability_zones.available.names) - domain = "vpc" - - depends_on = [aws_internet_gateway.core_igw] - - tags = merge({ - Name = "${var.vpc_name}_nat_gw_eip_${replace( - data.aws_availability_zones.available.names[count.index], - "-", - "_", - )}" - }, var.tags) -} - -# NAT Gateways for private subnets -resource "aws_nat_gateway" "core_nat_gw" { - count = length(data.aws_availability_zones.available.names) - subnet_id = aws_subnet.public_subnet[count.index].id - allocation_id = aws_eip.core_nat_gw_eip[count.index].id - - tags = merge({ - Name = "${var.vpc_name}_nat_gw_${replace( - data.aws_availability_zones.available.names[count.index], - "-", - "_", - )}" - }, var.tags) -} - -# Route tables for public/private subnets -resource "aws_route_table" "core_main_route_table" { - vpc_id = aws_vpc.core.id - - tags = merge({ - Name = "${var.vpc_name}_main_route_table_name" - }, var.tags) -} - -resource "aws_route_table" "core_private_route_table" { - count = length(data.aws_availability_zones.available.names) - vpc_id = aws_vpc.core.id - - tags = merge({ - Name = "${var.vpc_name}_private_route_table_${replace( - data.aws_availability_zones.available.names[count.index], - "-", - "_", - )}" - }, var.tags) -} - -# Default public route through the IGW -resource "aws_route" "core_main_route_table_public_default_route" { - route_table_id = aws_route_table.core_main_route_table.id - destination_cidr_block = "0.0.0.0/0" - gateway_id = aws_internet_gateway.core_igw.id -} - -# Default private route through the NAT gateways -resource "aws_route" "core_private_route_table_default_route" { - count = length(data.aws_availability_zones.available.names) - route_table_id = aws_route_table.core_private_route_table[count.index].id - destination_cidr_block = "0.0.0.0/0" - nat_gateway_id = aws_nat_gateway.core_nat_gw[count.index].id -} - -# Route table associations -resource "aws_main_route_table_association" "core_main_route_table_association" { - vpc_id = aws_vpc.core.id - route_table_id = aws_route_table.core_main_route_table.id -} diff --git a/infrastructure/modules/multihost-vpc/outputs.tf b/infrastructure/modules/multihost-vpc/outputs.tf deleted file mode 100644 index 9f395f63..00000000 --- a/infrastructure/modules/multihost-vpc/outputs.tf +++ /dev/null @@ -1,19 +0,0 @@ -output "vpc_id" { - value = aws_vpc.core.id - description = "The ID of the created VPC" -} - -output "vpc_cidr_range" { - value = aws_vpc.core.cidr_block - description = "The ID of the created VPC" -} - -output "private_route_table_ids" { - value = aws_route_table.core_private_route_table[*].id - description = "A list of private route table IDs" -} - -output "public_subnet_ids" { - value = aws_subnet.public_subnet[*].id - description = "A list of public subnet IDs" -} diff --git a/infrastructure/modules/multihost-vpc/variables.tf b/infrastructure/modules/multihost-vpc/variables.tf deleted file mode 100644 index 1d8335a3..00000000 --- a/infrastructure/modules/multihost-vpc/variables.tf +++ /dev/null @@ -1,54 +0,0 @@ -variable "tags" { - type = map(string) - description = "A map of tags to apply to all VPC resources" - default = {} -} - -variable "vpc_name" { - type = string - description = "The name of the VPC" - default = "core_vpc" -} - -variable "vpc_cidr_range" { - type = string - description = "The IP address space to use for the VPC" - default = "10.0.0.0/16" -} -# -variable "public_subnet_cidrs" { - type = list(string) - description = "A list of CIDRs for the public subnets. Needs to be the same amount as subnets in the Availability Zone you are deploying into (probably 3)" - default = [] -} - -variable "public_subnet_size" { - type = number - description = "The size of the public subnet (default: 1022 usable addresses)" - default = "6" -} - -variable "public_subnet_prefix" { - type = string - description = "The prefix to attach to the name of the public subnets" - default = "" -} - -variable "enable_dns_support" { - type = bool - description = "Whether or not to enable VPC DNS support" - default = true -} - -variable "enable_dns_hostnames" { - type = bool - description = "Whether or not to enable VPC DNS hostname support" - default = true -} -# -locals { - # We are using locals for this because there already is a fair amount of function calling inside the actual resources - public_subnet_prefix = length(var.public_subnet_prefix) > 0 ? var.public_subnet_prefix : "${var.vpc_name}_public_subnet" -} -# -data "aws_availability_zones" "available" {} diff --git a/infrastructure/modules/subnets/README.md b/infrastructure/modules/subnets/README.md deleted file mode 100644 index 0ef643c4d34383a8b37356bdd6ebb969cc671ece..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6761 zcmeHL-ELDy5S|y{9aiBcSi&x#auF3IL~n9Y8X?q+7UVd#V=Ot2>*J&irH_VqBwnH4 zx8w2b?l}(5X;N`fS&6+rGduIm@9vk+pT2zlbYJdEkk>Mn-{nH4vc#`5{LN)0mE2o@ zK4Q-+8N`(!9Q}elOYE4+Iregndq2v<j=IvgRbrouP_^6 ziFB>I_7|1 zC`m7#p8HY{{3!K%>`*Be(K57f4_Z+R;=00U1X+i1p1R~%Qx4OF{%)Ai?oF7OAC#Qj zA}QV#Fgii>j={NG!!TX_mJv$jyqW%k=rPl1j}usGhQAeT-IotQow!uMCEvve`c}{w zML!xKTbEvw%j}wU63q-N;}SA1<}sc_4uQxbMwMrfdJgz8qBexzPO;l!mE3})`5_2* zoC-^b&%9Ir9RlyzNVTs-Duv~z2FT z*0L98JnA{}xaUauX+?0!SPPtIDIHf+o@p-On({P{c!RvfES_i8kZ=fzOhFD|%L@C? zVNb3owMoMn))_y)&N+=?a#9N8#IA)NGKt?~)X4#&l>6va$1!f1OZPFyY)w=q@&GHk z!>eKd9i!U3oAmV_#!)SC?10vDCJ`rc?4ioKonuG4rIZ{yZIdla`ut?Iww-NudjV~j z!-#@e<7KqYYs`gp=j9g4&tUw!Zp?h_7svR}f6XQ*(KF046)eF{GsJIJD)yWlks{|8 zqFwy-7hAG#kYCr?m)0Ur@?%8{kYo(6oMHBAZDr-E{<0rE_8c`$>*N(Ep1==w^^;@t zBJUEfq1Rs5>+bF+jEqy@!Ag5`Pf4lU`AW*c@USSS1>JHQ!-sMN-7DZZfS(e1+I@w{ zqd)MjU>?AVz&?$A4(&9DjndV$FUvi`tTG3Ov&etB!TuO_d%PLVA>VCTfGnGGE zSR$ovXNif?Ys`VFvQ9u`_38fGJUz={05gp0gQrh2a&xcOeO+AvA_%7dG zyy7b7ZMT$T`Ahz8SphB~(=gru^-jRs9(%D#L&ep-=?#RxeSZ^9M&tE_@#{2(pY@d5 zKjsyXp5*Q}>@M|9n274#(XiC}T~mDin>(GMMXXA1aZR~;Jr>+iYHpJAPV7EZ z-iU42-Rfuk;Wi!n@DRPfU9YF@Ds{E_QqQkz$3D~E2l}`N(tDfxPJe&;8T}PsX!*b0 z3zWV%r|(7in{>Lumn3_kuD=lQzGSj|?Tvt5QqM|xkIraHZ_6AjomwV6&nl;P_}i(? SVofgtxddgNw>KR{;od(o#E_Q& diff --git a/infrastructure/modules/subnets/main.tf b/infrastructure/modules/subnets/main.tf deleted file mode 100644 index e1231828..00000000 --- a/infrastructure/modules/subnets/main.tf +++ /dev/null @@ -1,23 +0,0 @@ -# Subnets -# Private subnets -resource "aws_subnet" "private_subnet" { - count = length(data.aws_availability_zones.available.names) - vpc_id = var.vpc_id - cidr_block = length(var.private_subnet_cidrs) > 0 ? var.private_subnet_cidrs[count.index] : cidrsubnet(var.vpc_cidr_range, var.private_subnet_size, var.private_subnet_offset + count.index) - availability_zone = data.aws_availability_zones.available.names[count.index] - - tags = merge({ - Name = "${local.private_subnet_prefix}_${replace( - data.aws_availability_zones.available.names[count.index], - "-", - "_", - )}" - Scope = "private" }, - var.tags) -} - -resource "aws_route_table_association" "core_private_route_table_association" { - count = length(data.aws_availability_zones.available.names) - subnet_id = aws_subnet.private_subnet[count.index].id - route_table_id = var.core_private_route_table_ids[count.index] -} diff --git a/infrastructure/modules/subnets/outputs.tf b/infrastructure/modules/subnets/outputs.tf deleted file mode 100644 index 24444878..00000000 --- a/infrastructure/modules/subnets/outputs.tf +++ /dev/null @@ -1,4 +0,0 @@ -output "private_subnet_ids" { - value = aws_subnet.private_subnet[*].id - description = "A list of private subnet IDs" -} diff --git a/infrastructure/modules/subnets/variables.tf b/infrastructure/modules/subnets/variables.tf deleted file mode 100644 index 4d23daa9..00000000 --- a/infrastructure/modules/subnets/variables.tf +++ /dev/null @@ -1,76 +0,0 @@ -variable "tags" { - type = map(string) - description = "A map of tags to apply to all VPC resources" - default = {} -} -# -variable "vpc_name" { - type = string - description = "The name of the VPC" - default = "core_vpc" -} -# -variable "vpc_cidr_range" { - type = string - description = "The IP address space to use for the VPC" -} - -variable "vpc_id" { - type = string - description = "The VPC ID of the core VPC" -} - -variable "core_private_route_table_ids" { - type = list(string) - description = "The private route table IDs of the core to route private subnets to the Nat gateways " -} - -variable "public_subnet_cidrs" { - type = list(string) - description = "A list of CIDRs for the public subnets. Needs to be the same amount as subnets in the Availability Zone you are deploying into (probably 3)" - default = [] -} - -variable "public_subnet_size" { - type = number - description = "The size of the public subnet (default: 1022 usable addresses)" - default = "6" -} - -variable "private_subnet_cidrs" { - type = list(string) - description = "A list of CIDRs for the private subnets. Needs to be the same amount as subnets in the Availability Zone you are deploying into (probably 3)" - default = [] -} - -variable "private_subnet_size" { - type = number - description = "The size of the private subnet (default: 1022 usable addresses)" - default = 6 -} - -variable "private_subnet_offset" { - type = number - description = "The amount of IP space between the public and the private subnet" - default = 32 -} - -variable "public_subnet_prefix" { - type = string - description = "The prefix to attach to the name of the public subnets" - default = "" -} - -variable "private_subnet_prefix" { - type = string - description = "The prefix to attach to the name of the private subnets" - default = "" -} - -locals { - # We are using locals for this because there already is a fair amount of function calling inside the actual resources - public_subnet_prefix = length(var.public_subnet_prefix) > 0 ? var.public_subnet_prefix : "${var.vpc_name}_public_subnet" - private_subnet_prefix = length(var.private_subnet_prefix) > 0 ? var.private_subnet_prefix : "${var.vpc_name}_private_subnet" -} - -data "aws_availability_zones" "available" {} diff --git a/infrastructure/modules/subnets/versions.tf b/infrastructure/modules/subnets/versions.tf deleted file mode 100644 index f3355dbf..00000000 --- a/infrastructure/modules/subnets/versions.tf +++ /dev/null @@ -1,4 +0,0 @@ - -terraform { - required_version = ">= 1.5" -} From b1270594939a13426f5e0ffd12134915cbb148a9 Mon Sep 17 00:00:00 2001 From: Abigail Muller Date: Wed, 4 Feb 2026 15:01:49 +0000 Subject: [PATCH 13/13] default kms key --- infrastructure/blocks/s3/main.tf | 8 ++------ infrastructure/modules/app-cluster/main.tf | 17 +++++++++++++++++ infrastructure/modules/data-workflow/athena.tf | 6 ++---- 3 files changed, 21 insertions(+), 10 deletions(-) diff --git a/infrastructure/blocks/s3/main.tf b/infrastructure/blocks/s3/main.tf index 97af25dd..2ab51ad6 100644 --- a/infrastructure/blocks/s3/main.tf +++ b/infrastructure/blocks/s3/main.tf @@ -6,7 +6,6 @@ terraform { resource "aws_s3_bucket" "rapid_data_storage" { #checkov:skip=CKV_AWS_144:No need for cross region replication - #checkov:skip=CKV_AWS_145:No need for non default key #checkov:skip=CKV2_AWS_62:No need for event notifications #checkov:skip=CKV2_AWS_61:No need for lifecycle configuration bucket = var.data_bucket_name @@ -20,8 +19,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "rapid_data_storag rule { apply_server_side_encryption_by_default { - kms_master_key_id = "" # use default - sse_algorithm = "AES256" + sse_algorithm = "aws:kms" } } } @@ -71,7 +69,6 @@ resource "aws_s3_bucket_notification" "rapid_data_storage" { resource "aws_s3_bucket" "logs" { #checkov:skip=CKV_AWS_144:No need for cross region replication - #checkov:skip=CKV_AWS_145:No need for non default key #checkov:skip=CKV_AWS_18:Log bucket shouldn't be logging #checkov:skip=CKV_AWS_21:No need to version log bucket #checkov:skip=CKV2_AWS_62:No need for event notifications @@ -87,8 +84,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "logs" { rule { apply_server_side_encryption_by_default { - kms_master_key_id = "" # use default - sse_algorithm = "AES256" + sse_algorithm = "aws:kms" } } } diff --git a/infrastructure/modules/app-cluster/main.tf b/infrastructure/modules/app-cluster/main.tf index 02767227..6940c209 100644 --- a/infrastructure/modules/app-cluster/main.tf +++ b/infrastructure/modules/app-cluster/main.tf @@ -66,6 +66,14 @@ resource "aws_iam_policy" "app_s3_access" { "s3:PutObject" ], "Resource" : "${var.data_s3_bucket_arn}/data/schemas/**/*.json" + }, + { + "Effect" : "Allow", + "Action" : [ + "kms:Decrypt", + "kms:GenerateDataKey" + ], + "Resource" : "arn:aws:kms:${var.aws_region}:${var.aws_account}:alias/aws/s3" } ] }) @@ -119,6 +127,15 @@ resource "aws_iam_policy" "app_athena_query_access" { var.athena_query_output_bucket_arn, "${var.athena_query_output_bucket_arn}/*" ] + }, + { + "Sid" : "KMSAccess", + "Effect" : "Allow", + "Action" : [ + "kms:Decrypt", + "kms:GenerateDataKey" + ], + "Resource" : "arn:aws:kms:${var.aws_region}:${var.aws_account}:alias/aws/s3" } ] }) diff --git a/infrastructure/modules/data-workflow/athena.tf b/infrastructure/modules/data-workflow/athena.tf index c8fd0bad..547f02a7 100644 --- a/infrastructure/modules/data-workflow/athena.tf +++ b/infrastructure/modules/data-workflow/athena.tf @@ -1,6 +1,5 @@ resource "aws_s3_bucket" "rapid_athena_query_results_bucket" { #checkov:skip=CKV_AWS_144:No need for cross region replication - #checkov:skip=CKV_AWS_145:No need for non default key #checkov:skip=CKV_AWS_21:No need to version query results #checkov:skip=CKV_AWS_18:No need to log query results #checkov:skip=CKV2_AWS_62:No need for event notifications @@ -15,7 +14,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "rapid_athena_quer rule { apply_server_side_encryption_by_default { - sse_algorithm = "AES256" + sse_algorithm = "aws:kms" } } } @@ -58,8 +57,7 @@ resource "aws_athena_workgroup" "rapid_athena_workgroup" { output_location = "s3://${aws_s3_bucket.rapid_athena_query_results_bucket.bucket}" encryption_configuration { - encryption_option = "SSE_S3" - # kms_key_arn = "" + encryption_option = "SSE_KMS" } } }