Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refactoring Terraform For Scratch Deployment #721

Closed
wants to merge 8 commits into from
Closed

Refactoring Terraform For Scratch Deployment #721

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
44cdf0c
Adding config file for aws-nuke in scratch environment
ben851 Apr 20, 2023
41a5df2
Adding scratch config baseline - copied from staging
ben851 Apr 20, 2023
7449efa
Merge branch 'main' of github.com:cds-snc/notification-terraform into…
ben851 Apr 20, 2023
63ed8a5
Imported notify internal task queue in staging
ben851 Apr 20, 2023
8f90d55
TF Formatting
ben851 Apr 20, 2023
72179b0
Formatting
ben851 Apr 20, 2023
1ab2df0
Merging existing main
ben851 Apr 24, 2023
cd8c049
Verifying cmomon works in scratch
ben851 Apr 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions aws/common/athena.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ resource "aws_athena_database" "notification_athena" {
}

resource "aws_athena_workgroup" "primary" {
name = "primary"
name = var.athena_workgroup_name

configuration {
enforce_workgroup_configuration = true
Expand Down Expand Up @@ -40,7 +40,7 @@ resource "aws_athena_named_query" "create_table_alb_logs" {
{
database_name = aws_athena_database.notification_athena.name
table_name = "alb_logs"
bucket_location = "s3://${var.cbs_satellite_bucket_name}/lb_logs/AWSLogs/${var.account_id}/elasticloadbalancing/${var.region}/"
bucket_location = "s3://${aws_s3_bucket.cbs_sensor_bucket.bucket}/lb_logs/AWSLogs/${var.account_id}/elasticloadbalancing/${var.region}/"
})
}

Expand All @@ -52,7 +52,7 @@ resource "aws_athena_named_query" "create_table_waf_logs" {
{
database_name = aws_athena_database.notification_athena.name
table_name = "waf_logs_lb"
bucket_location = "s3://${var.cbs_satellite_bucket_name}/waf_acl_logs/AWSLogs/${var.account_id}/lb/"
bucket_location = "s3://${aws_s3_bucket.cbs_sensor_bucket.bucket}/waf_acl_logs/AWSLogs/${var.account_id}/lb/"
})
}

Expand All @@ -64,7 +64,7 @@ resource "aws_athena_named_query" "create_table_waf_logs_api_lambda" {
{
database_name = aws_athena_database.notification_athena.name
table_name = "waf_logs_api_lambda"
bucket_location = "s3://${var.cbs_satellite_bucket_name}/waf_acl_logs/AWSLogs/${var.account_id}/lambda/"
bucket_location = "s3://${aws_s3_bucket.cbs_sensor_bucket.bucket}/waf_acl_logs/AWSLogs/${var.account_id}/lambda/"
})
}

Expand All @@ -76,6 +76,6 @@ resource "aws_athena_named_query" "create_table_all_waf_logs" {
{
database_name = aws_athena_database.notification_athena.name
table_name = "waf_logs"
bucket_location = "s3://${var.cbs_satellite_bucket_name}/waf_acl_logs/AWSLogs/${var.account_id}/"
bucket_location = "s3://${aws_s3_bucket.cbs_sensor_bucket.bucket}/waf_acl_logs/AWSLogs/${var.account_id}/"
})
}
4 changes: 2 additions & 2 deletions aws/common/iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,8 +274,8 @@ data "aws_iam_policy_document" "firehose_waf_logs" {
"s3:PutObject"
]
resources = [
"arn:aws:s3:::${var.cbs_satellite_bucket_name}",
"arn:aws:s3:::${var.cbs_satellite_bucket_name}/*"
"arn:aws:s3:::${aws_s3_bucket.cbs_sensor_bucket.bucket}",
"arn:aws:s3:::${aws_s3_bucket.cbs_sensor_bucket.bucket}/*"
]
}
statement {
Expand Down
2 changes: 1 addition & 1 deletion aws/common/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,5 +135,5 @@ output "sns_deliveries_failures_us_west_2_name" {
}

output "sqs_notify_internal_tasks_arn" {
value = data.aws_sqs_queue.notify-internal-tasks.arn
value = aws_sqs_queue.notify_internal_tasks_queue.arn
}
147 changes: 141 additions & 6 deletions aws/common/s3.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,6 @@ resource "aws_s3_bucket_public_access_block" "csv_bucket" {

resource "aws_s3_bucket" "csv_bucket_logs" {
bucket = "notification-canada-ca-${var.env}-csv-upload-logs"
acl = "log-delivery-write"
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
Expand All @@ -69,6 +68,32 @@ resource "aws_s3_bucket" "csv_bucket_logs" {
#tfsec:ignore:AWS077 - Versioning is not enabled
}

resource "aws_s3_bucket_public_access_block" "csv_bucket_logs" {
bucket = aws_s3_bucket.csv_bucket_logs.id

block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "csv_bucket_logs" {
bucket = aws_s3_bucket.csv_bucket_logs.id
rule {
object_ownership = "BucketOwnerPreferred"
}
}

resource "aws_s3_bucket_acl" "csv_bucket_logs" {
depends_on = [
aws_s3_bucket_public_access_block.csv_bucket_logs,
aws_s3_bucket_ownership_controls.csv_bucket_logs,
]

bucket = aws_s3_bucket.csv_bucket_logs.id
acl = "log-delivery-write"
}

resource "aws_s3_bucket" "bulk_send" {
bucket = "notification-canada-ca-${var.env}-bulk-send"
acl = "private"
Expand Down Expand Up @@ -110,7 +135,6 @@ resource "aws_s3_bucket_public_access_block" "bulk_send" {

resource "aws_s3_bucket" "bulk_send_logs" {
bucket = "notification-canada-ca-${var.env}-bulk-send-logs"
acl = "log-delivery-write"
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
Expand All @@ -135,15 +159,33 @@ resource "aws_s3_bucket" "bulk_send_logs" {
#tfsec:ignore:AWS077 - Versioning is not enabled
}

resource "aws_s3_bucket_public_access_block" "csv_bucket_logs" {
bucket = aws_s3_bucket.csv_bucket_logs.id
resource "aws_s3_bucket_public_access_block" "bulk_send_logs" {
bucket = aws_s3_bucket.bulk_send_logs.id

block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "bulk_send_logs" {
bucket = aws_s3_bucket.bulk_send_logs.id
rule {
object_ownership = "BucketOwnerPreferred"
}
}

resource "aws_s3_bucket_acl" "bulk_send_logs" {
depends_on = [
aws_s3_bucket_public_access_block.bulk_send_logs,
aws_s3_bucket_ownership_controls.bulk_send_logs,
]

bucket = aws_s3_bucket.bulk_send_logs.id
acl = "log-delivery-write"
}


resource "aws_s3_bucket" "asset_bucket" {
bucket = "notification-canada-ca-${var.env}-asset-upload"
server_side_encryption_configuration {
Expand Down Expand Up @@ -301,7 +343,6 @@ resource "aws_s3_bucket_public_access_block" "scan_files_document_bucket" {

resource "aws_s3_bucket" "document_bucket_logs" {
bucket = "notification-canada-ca-${var.env}-document-download-logs"
acl = "log-delivery-write"
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
Expand Down Expand Up @@ -335,6 +376,23 @@ resource "aws_s3_bucket_public_access_block" "document_bucket_logs" {
restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "document_bucket_logs" {
bucket = aws_s3_bucket.document_bucket_logs.id
rule {
object_ownership = "BucketOwnerPreferred"
}
}

resource "aws_s3_bucket_acl" "document_bucket_logs" {
depends_on = [
aws_s3_bucket_public_access_block.document_bucket_logs,
aws_s3_bucket_ownership_controls.document_bucket_logs,
]

bucket = aws_s3_bucket.document_bucket_logs.id
acl = "log-delivery-write"
}

resource "aws_s3_bucket" "alb_log_bucket" {
bucket = "notification-canada-ca-${var.env}-alb-logs"
acl = "private"
Expand Down Expand Up @@ -454,7 +512,6 @@ resource "aws_s3_bucket_public_access_block" "athena_bucket" {

resource "aws_s3_bucket" "athena_bucket_logs" {
bucket = "notification-canada-ca-${var.env}-athena-logs"
acl = "log-delivery-write"
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
Expand All @@ -478,3 +535,81 @@ resource "aws_s3_bucket" "athena_bucket_logs" {
#tfsec:ignore:AWS002 - Ignore log of logs
#tfsec:ignore:AWS077 - Versioning is not enabled
}

resource "aws_s3_bucket_public_access_block" "athena_bucket_logs" {
bucket = aws_s3_bucket.athena_bucket_logs.id

block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "athena_bucket_logs" {
bucket = aws_s3_bucket.athena_bucket_logs.id
rule {
object_ownership = "BucketOwnerPreferred"
}
}

resource "aws_s3_bucket_acl" "athena_bucket_logs" {
depends_on = [
aws_s3_bucket_public_access_block.athena_bucket_logs,
aws_s3_bucket_ownership_controls.athena_bucket_logs,
]

bucket = aws_s3_bucket.athena_bucket_logs.id
acl = "log-delivery-write"
}

resource "aws_s3_bucket" "cbs_sensor_bucket" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you seen our Terraform modules?

https://github.com/cds-snc/terraform-modules

We have modules for S3 Buckets that might be useful.

When v5 of the AWS Provider comes out and this type of bucket is finally deprecated I plan on fixing the s3 bucket module so it automatically refactors to the new way of building them.

It also configures them in a consistent that meets some of our organizational defined best practices.

It's not 100% perfect so open to any issues that can help us secure and make our orgs infra better.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good Calvin. I'd probably still proceed with this PR for now, but once we're back into a state where things actually build I'll do some investigation in to what modules we can leverage. Happy to be a contributor to make them as useful and secure as possible 👍

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right now the CBS bucket is being managed here for all accounts:
https://github.com/cds-snc/cloud-based-sensor

If you want to bring it into this repo you'll need to do a bit of IAM setup and add replication rules so it can send objects to the log archive account's bucket:
https://github.com/cds-snc/cloud-based-sensor/tree/main/terragrunt/aws/satellite_bucket

Happy to chat about this if you want more details.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Pat - based on this info I think I will refactor this.

bucket = "cbs-satellite-${var.account_id}"
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
}

lifecycle_rule {
enabled = true

expiration {
days = 14
}
}

tags = {
CostCenter = "notification-canada-ca-${var.env}"
}

#tfsec:ignore:AWS002 - Ignore log of logs
#tfsec:ignore:AWS077 - Versioning is not enabled
}

resource "aws_s3_bucket_public_access_block" "cbs_sensor_bucket" {
bucket = aws_s3_bucket.cbs_sensor_bucket.id

block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "cbs_sensor_bucket" {
bucket = aws_s3_bucket.cbs_sensor_bucket.id
rule {
object_ownership = "BucketOwnerPreferred"
}
}

resource "aws_s3_bucket_acl" "cbs_sensor_bucket" {
depends_on = [
aws_s3_bucket_public_access_block.cbs_sensor_bucket,
aws_s3_bucket_ownership_controls.cbs_sensor_bucket,
]

bucket = aws_s3_bucket.cbs_sensor_bucket.id
acl = "log-delivery-write"
}
9 changes: 5 additions & 4 deletions aws/common/sqs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,9 @@ resource "aws_sqs_queue" "bulk_db_tasks_queue" {
# AWS managed encryption is good enough for us
}

# We are doing this here as it is required for ses_receiving_emails lambda
# That folder is configured to use us-east-1, but the below queue is in ca-central-1
data "aws_sqs_queue" "notify-internal-tasks" {
name = "${var.celery_queue_prefix}notify-internal-tasks"
resource "aws_sqs_queue" "notify_internal_tasks_queue" {
name = "${var.celery_queue_prefix}notify-internal-tasks"
sqs_managed_sse_enabled = false
# This queue was created outside of terraform and has this value set to false in staging and production.
visibility_timeout_seconds = 310
}
6 changes: 6 additions & 0 deletions aws/common/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,3 +211,9 @@ variable "alarm_critical_expired_email_created_threshold" {
description = "Critical alarm threshold for expired email batches created"
type = number
}

variable "athena_workgroup_name" {
description = "The name of the athena workgroup. This resource seems to be created by default in new environments and thus needs to be overridden. For prod and staging, the default primary is sufficient"
type = string
default = "primary"
}
2 changes: 1 addition & 1 deletion aws/common/vpc.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@ resource "aws_default_network_acl" "notification-canada-ca" {
}

resource "aws_flow_log" "cloud-based-sensor" {
log_destination = "arn:aws:s3:::${var.cbs_satellite_bucket_name}/vpc_flow_logs/"
log_destination = aws_s3_bucket.cbs_sensor_bucket.arn
log_destination_type = "s3"
traffic_type = "ALL"
vpc_id = aws_vpc.notification-canada-ca.id
Expand Down
2 changes: 1 addition & 1 deletion aws/eks/alb.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ resource "aws_alb" "notification-canada-ca" {
subnets = var.vpc_public_subnets

access_logs {
bucket = var.cbs_satellite_bucket_name
bucket = aws_s3_bucket.cbs_sensor_bucket.bucket
prefix = "lb_logs"
enabled = true
}
Expand Down
2 changes: 1 addition & 1 deletion aws/eks/waf.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -593,7 +593,7 @@ resource "aws_kinesis_firehose_delivery_stream" "firehose-waf-logs" {
extended_s3_configuration {
role_arn = var.firehose_waf_logs_iam_role_arn
prefix = "waf_acl_logs/AWSLogs/${var.account_id}/lb/"
bucket_arn = "arn:aws:s3:::${var.cbs_satellite_bucket_name}"
bucket_arn = "arn:aws:s3:::${aws_s3_bucket.cbs_sensor_bucket.bucket}"
compression_format = "GZIP"

# Buffer incoming data size (MB), before delivering to S3 bucket
Expand Down
2 changes: 1 addition & 1 deletion aws/lambda-api/waf.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,7 +366,7 @@ resource "aws_kinesis_firehose_delivery_stream" "firehose-api-lambda-waf-logs" {
extended_s3_configuration {
role_arn = var.firehose_waf_logs_iam_role_arn
prefix = "waf_acl_logs/AWSLogs/${var.account_id}/lambda/"
bucket_arn = "arn:aws:s3:::${var.cbs_satellite_bucket_name}"
bucket_arn = "arn:aws:s3:::${aws_s3_bucket.cbs_sensor_bucket.bucket}"
compression_format = "GZIP"

# Buffer incoming data size (MB), before delivering to S3 bucket
Expand Down
Loading