Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: create records using for_each instead of count #37

Merged
merged 7 commits into from
Jan 27, 2022
Merged

Fix: create records using for_each instead of count #37

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
fe7302e
create records using for_each instead of count
1david5 Jan 26, 2022
228735a
Auto Format
cloudpossebot Jan 26, 2022
7c53db1
Merge branch 'master' into use-for_each
korenyoni Jan 27, 2022
1d30af3
Merge branch 'master' into use-for_each
korenyoni Jan 27, 2022
56ef10f
Auto Format
cloudpossebot Jan 27, 2022
3b1f63f
Update contributors list.
korenyoni Jan 27, 2022
1fecf04
Auto Format
cloudpossebot Jan 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@ data "aws_route53_zone" "default" {
}

resource "aws_route53_record" "default" {
count = module.this.enabled ? length(compact(var.aliases)) : 0
for_each = module.this.enabled ? toset(compact(var.aliases)) : []
Copy link

@bridgecrew bridgecrew bot Jan 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure Route53 A Record has an attached resource
    Resource: aws_route53_record.default | ID: BC_AWS_GENERAL_95

Description

This check ensures that Route53 A records point to resources part of your Account rather than just random IP addresses. On the platform this check additionally compares IP's against provisioned EIP. In Checkov the graph correlates the A record against know AWS resources from EIP to Global Accelerator.

Copy link

@bridgecrew bridgecrew bot Jan 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure Route 53 entries relate to account resources only
    Resource: aws_route53_record.default | ID: BC_AWS_NETWORKING_60

Description

Checks that all A records in Route 53 point to resources created in the current AWS account.

#Rationale
A check to protect against domain hijacking, where an unrelated IP address is added to an AWS managed DNS zone.

korenyoni marked this conversation as resolved.
Show resolved Hide resolved
korenyoni marked this conversation as resolved.
Show resolved Hide resolved
zone_id = try(data.aws_route53_zone.default[0].zone_id, "")
name = compact(var.aliases)[count.index]
name = each.key
allow_overwrite = var.allow_overwrite
type = "A"

Expand All @@ -20,9 +20,9 @@ resource "aws_route53_record" "default" {
}

resource "aws_route53_record" "ipv6" {
count = module.this.enabled && var.ipv6_enabled ? length(compact(var.aliases)) : 0
for_each = module.this.enabled && var.ipv6_enabled ? toset(compact(var.aliases)) : []
zone_id = try(data.aws_route53_zone.default[0].zone_id, "")
name = compact(var.aliases)[count.index]
name = each.key
allow_overwrite = var.allow_overwrite
type = "AAAA"

Expand Down
2 changes: 1 addition & 1 deletion outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
output "hostnames" {
value = aws_route53_record.default.*.fqdn
value = try([for alias in var.aliases : aws_route53_record.default[alias].fqdn], [])
description = "List of DNS records"
}

Expand Down