Aws v4 refactor #113
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -2,53 +2,44 @@ data "aws_caller_identity" "default" {} | |||||
|
|
||||||
| data "aws_region" "default" {} | ||||||
|
|
||||||
| module "cache_bucket" { | ||||||
|
There was a problem hiding this comment. Usually when we create a breaking change like this, we release a "minor" release but we also include with it some kind of "migration" document which we create by first applying the current release, then running through terraform state moves and other API changes, then we can apply the new version (this version) and make sure it returns "no changes". Those steps are documented inside of docs/ and added to the README.yaml so other people will know how to safely migrate from version 0.x to version 0.y. There was a problem hiding this comment. I ran the tests below just to make sure you were on the correct path with the current proposed changes but I think a migration doc is the right way to go. cc: @Nuru There was a problem hiding this comment. I added a migration doc @nitrocode |
||||||
| #bridgecrew:skip=BC_AWS_S3_13:Skipping `Enable S3 Bucket Logging` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776). | ||||||
| #bridgecrew:skip=BC_AWS_S3_14:Skipping `Ensure all data stored in the S3 bucket is securely encrypted at rest` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776). | ||||||
| #bridgecrew:skip=CKV_AWS_52:Skipping `Ensure S3 bucket has MFA delete enabled` due to issue in terraform (https://github.com/hashicorp/terraform-provider-aws/issues/629). | ||||||
| source = "cloudposse/s3-bucket/aws" | ||||||
| version = "2.0.3" | ||||||
|
|
||||||
| count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0 | ||||||
| bucket_name = local.cache_bucket_name_normalised | ||||||
|
|
||||||
| acl = true | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| force_destroy = true | ||||||
| tags = module.this.tags | ||||||
| versioning_enabled = var.versioning_enabled | ||||||
| logging = { | ||||||
| bucket_name = var.access_log_bucket_name | ||||||
| prefix = "logs/${module.this.id}/" | ||||||
| } | ||||||
| lifecycle_configuration_rules = [ | ||||||
| # Be sure to cover https://github.com/cloudposse/terraform-aws-s3-bucket/issues/137 | ||||||
| { | ||||||
| enabled = true | ||||||
| id = "codebuildcache" | ||||||
| abort_incomplete_multipart_upload_days = 1 | ||||||
| prefix = "/" | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| tags = module.this.tags | ||||||
| filter_and = {} | ||||||
| noncurrent_version_expiration = {} | ||||||
| noncurrent_version_transition = [] | ||||||
| transition = [{}] | ||||||
| expiration = { | ||||||
| days = var.cache_expiration_days | ||||||
| expired_object_delete_marker = null | ||||||
| } | ||||||
| } | ||||||
| ] | ||||||
| bucket_key_enabled = true | ||||||
| } | ||||||
| resource "random_string" "bucket_prefix" { | ||||||
| count = module.this.enabled ? 1 : 0 | ||||||
| length = 12 | ||||||
|
|
@@ -71,7 +62,7 @@ locals { | |||||
|
|
||||||
| s3_cache_enabled = var.cache_type == "S3" | ||||||
| create_s3_cache_bucket = local.s3_cache_enabled && var.s3_cache_bucket_name == null | ||||||
| s3_bucket_name = local.create_s3_cache_bucket ? join("", module.cache_bucket.*.bucket) : var.s3_cache_bucket_name | ||||||
|
|
||||||
| ## This is the magic where a map of a list of maps is generated | ||||||
| ## and used to conditionally add the cache bucket option to the | ||||||
|
|
@@ -265,8 +256,8 @@ data "aws_iam_policy_document" "permissions_cache_bucket" { | |||||
| effect = "Allow" | ||||||
|
|
||||||
| resources = [ | ||||||
| join("", module.cache_bucket.*.bucket_arn), | ||||||
| "${join("", module.cache_bucket.*.bucket_arn)}/*", | ||||||
| ] | ||||||
| } | ||||||
| } | ||||||
|
|
@@ -325,7 +316,7 @@ resource "aws_codebuild_project" "default" { | |||||
| type = "S3" | ||||||
| location = var.secondary_artifact_location | ||||||
| artifact_identifier = var.secondary_artifact_identifier | ||||||
| encryption_disabled = !var.secondary_artifact_encryption_enabled | ||||||
| # According to AWS documention, in order to have the artifacts written | ||||||
| # to the root of the bucket, the 'namespace_type' should be 'NONE' | ||||||
| # (which is the default), 'name' should be '/', and 'path' should be | ||||||
|
|
||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,12 +20,12 @@ output "role_arn" { | |
|
|
||
| output "cache_bucket_name" { | ||
| description = "Cache S3 bucket name" | ||
| value = module.this.enabled && local.s3_cache_enabled ? join("", module.cache_bucket.*.bucket) : "UNSET" | ||
| } | ||
|
|
||
| output "cache_bucket_arn" { | ||
| description = "Cache S3 bucket ARN" | ||
| value = module.this.enabled && local.s3_cache_enabled ? join("", module.cache_bucket.*.bucket_arn) : "UNSET" | ||
| } | ||
|
|
||
| output "badge_url" { | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,10 @@ | ||
| terraform { | ||
| required_version = ">= 1.0.0" | ||
nitrocode marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = ">= 4.21.0" | ||
nitrocode marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
| random = { | ||
| source = "hashicorp/random" | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.