diff --git a/README copy.md b/README copy.md deleted file mode 100644 index afe73bb..0000000 --- a/README copy.md +++ /dev/null @@ -1,118 +0,0 @@ - -## Requirements - -| Name | Version | -|------|---------| -| [dockerless](#requirement\_dockerless) | 0.1.1 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | -| [dockerless](#provider\_dockerless) | 0.1.1 | -| [null](#provider\_null) | n/a | -| [random](#provider\_random) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_alb.ecs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/alb) | resource | -| [aws_alb_listener.http](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/alb_listener) | resource | -| [aws_alb_listener_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/alb_listener_rule) | resource | -| [aws_alb_target_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/alb_target_group) | resource | -| [aws_appmesh_mesh.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appmesh_mesh) | resource | -| [aws_appmesh_virtual_node.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appmesh_virtual_node) | resource | -| [aws_cloudwatch_log_group.ecs_cloudwatch_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | -| [aws_ecr_repository.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource | -| [aws_ecs_cluster.dibbs_app_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource | -| [aws_ecs_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource | -| [aws_ecs_task_definition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource | -| [aws_flow_log.ecs_flow_log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource | -| [aws_iam_policy.s3_bucket_ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.ecs_task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role.ecs_task_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role.s3_role_for_ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_s3_bucket.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_public_access_block.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_s3_bucket_versioning.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | -| [aws_security_group.alb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | -| [aws_security_group.ecs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | -| [aws_security_group_rule.alb_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | -| [aws_security_group_rule.alb_http_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | -| [aws_security_group_rule.alb_https_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | -| [aws_security_group_rule.ecs_alb_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | -| [aws_security_group_rule.ecs_all_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | -| [aws_security_group_rule.ecs_ecs_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | -| [aws_service_discovery_private_dns_namespace.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/service_discovery_private_dns_namespace) | resource | -| [aws_vpc_endpoint.endpoints](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource | -| [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource | -| [dockerless_remote_image.dibbs](https://registry.terraform.io/providers/nullstone-io/dockerless/0.1.1/docs/resources/remote_image) | resource | -| [null_resource.target_groups](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | -| [random_string.s3_viewer](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_ecr_authorization_token.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | -| [aws_iam_policy.amazon_ec2_container_service_for_ec2_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | -| [aws_iam_policy.ecs_task_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | -| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.ecr_viewer_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_route_table.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route_table) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [appmesh\_name](#input\_appmesh\_name) | Name of the AWS App Mesh | `string` | `""` | no | -| [cloudmap\_namespace\_name](#input\_cloudmap\_namespace\_name) | Name of the AWS Cloud Map namespace | `string` | `""` | no | -| [cloudmap\_service\_name](#input\_cloudmap\_service\_name) | Name of the AWS Cloud Map service | `string` | `""` | no | -| [cw\_retention\_in\_days](#input\_cw\_retention\_in\_days) | Retention period in days for CloudWatch logs | `number` | `30` | no | -| [disable\_ecr](#input\_disable\_ecr) | Flag to disable the aws ecr service for docker image storage, defaults to false | `bool` | `false` | no | -| [ecr\_viewer\_app\_env](#input\_ecr\_viewer\_app\_env) | The current environment that is running. This may modify behavior of auth between dev and prod. | `string` | `"prod"` | no | -| [ecr\_viewer\_auth\_pub\_key](#input\_ecr\_viewer\_auth\_pub\_key) | The public key used to validate the incoming authenication for the eCR Viewer. | `string` | `"-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqjrH9PprQCB5dX15zYfd\nS6K2ezNi/ZOu8vKEhQuLqwHACy1iUt1Yyp2PZLIV7FVDgBHMMVWPVx3GJ2wEyaJw\nMHkv6XNpUpWLhbs0V1T7o/OZfEIqcNua07OEoBxX9vhKIHtaksWdoMyKRXQJz0js\noWpawfOWxETnLqGvybT4yvY2RJhquTXLcLu90L4LdvIkADIZshaOtAU/OwI5ATcb\nfE3ip15E6jIoUm7FAtfRiuncpI5l/LJPP6fvwf8QCbbUJBZklLqcUuf4qe/L/nIq\npIONb8KZFWPhnGeRZ9bwIcqYWt3LAAshQLSGEYl2PGXaqbkUD2XLETSKDjisxd0g\n9j8bIMPgBKi+dBYcmBZnR7DxJe+vEDDw8prHG/+HRy5fim/BcibTKnIl8PR5yqHa\nmWQo7N+xXhILdD9e33KLRgbg97+erHqvHlNMdwDhAfrBT+W6GCdPwp3cePPsbhsc\noGSHOUDhzyAujr0J8h5WmZDGUNWjGzWqubNZD8dBXB8x+9dDoWhfM82nw0pvAeKf\nwJodvn3Qo8/S5hxJ6HyGkUTANKN8IxWh/6R5biET5BuztZP6jfPEaOAnt6sq+C38\nhR9rUr59dP2BTlcJ19ZXobLwuJEa81S5BrcbDwYNOAzC8jl2EV1i4bQIwJJaY27X\nIynom6unaheZpS4DFIh2w9UCAwEAAQ==\n-----END PUBLIC KEY-----\n"` | no | -| [ecr\_viewer\_basepath](#input\_ecr\_viewer\_basepath) | The basepath for the ecr-viewer | `string` | `"/ecr-viewer"` | no | -| [ecs\_alb\_name](#input\_ecs\_alb\_name) | Name of the Application Load Balancer (ALB) | `string` | `""` | no | -| [ecs\_alb\_sg](#input\_ecs\_alb\_sg) | Name of the ECS ALB Security Group | `string` | `""` | no | -| [ecs\_alb\_tg\_name](#input\_ecs\_alb\_tg\_name) | Name of the ALB Target Group | `string` | `""` | no | -| [ecs\_cloudwatch\_group](#input\_ecs\_cloudwatch\_group) | Name of the AWS CloudWatch Log Group for ECS | `string` | `""` | no | -| [ecs\_cluster\_name](#input\_ecs\_cluster\_name) | Name of the ECS Cluster | `string` | `""` | no | -| [ecs\_task\_execution\_role\_name](#input\_ecs\_task\_execution\_role\_name) | Name of the ECS Task Execution Role | `string` | `""` | no | -| [ecs\_task\_role\_name](#input\_ecs\_task\_role\_name) | Name of the ECS Task Role | `string` | `""` | no | -| [internal](#input\_internal) | Flag to determine if the several AWS resources are public (intended for external access, public internet) or private (only intended to be accessed within your AWS VPC or avaiable with other means, a transit gateway for example). | `bool` | `true` | no | -| [non\_integrated\_viewer](#input\_non\_integrated\_viewer) | A flag to determine if the viewer is the non-integrated version | `string` | `"false"` | no | -| [owner](#input\_owner) | Owner of the resources | `string` | `"CDC"` | no | -| [phdi\_version](#input\_phdi\_version) | Version of the PHDI application | `string` | `"v1.6.9"` | no | -| [private\_subnet\_ids](#input\_private\_subnet\_ids) | List of private subnet IDs | `list(string)` | n/a | yes | -| [project](#input\_project) | The project name | `string` | `"dibbs"` | no | -| [public\_subnet\_ids](#input\_public\_subnet\_ids) | List of public subnet IDs | `list(string)` | n/a | yes | -| [region](#input\_region) | The AWS region where resources are created | `string` | n/a | yes | -| [s3\_viewer\_bucket\_name](#input\_s3\_viewer\_bucket\_name) | Name of the S3 bucket for the viewer | `string` | `""` | no | -| [s3\_viewer\_bucket\_role\_name](#input\_s3\_viewer\_bucket\_role\_name) | Name of the IAM role for the ecr-viewer bucket | `string` | `""` | no | -| [service\_data](#input\_service\_data) | Data for the DIBBS services | 
map(object({
    short_name     = string
    fargate_cpu    = number
    fargate_memory = number
    app_count      = number
    app_image      = string
    app_version    = string
    container_port = number
    host_port      = number
    public         = bool
    registry_url   = string
    env_vars = list(object({
      name  = string
      value = string
    }))
  }))
| `{}` | no | -| [tags](#input\_tags) | Tags to apply to resources | `map(string)` | `{}` | no | -| [vpc\_id](#input\_vpc\_id) | ID of the VPC | `string` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [alb\_arn](#output\_alb\_arn) | n/a | -| [alb\_listener\_arn](#output\_alb\_listener\_arn) | n/a | -| [alb\_listener\_rules\_arns](#output\_alb\_listener\_rules\_arns) | n/a | -| [alb\_security\_group\_arn](#output\_alb\_security\_group\_arn) | n/a | -| [alb\_target\_groups\_arns](#output\_alb\_target\_groups\_arns) | n/a | -| [ecs\_cluster\_arn](#output\_ecs\_cluster\_arn) | n/a | -| [ecs\_security\_group\_arn](#output\_ecs\_security\_group\_arn) | n/a | -| [ecs\_task\_definitions\_arns](#output\_ecs\_task\_definitions\_arns) | n/a | -| [ecs\_task\_execution\_role\_arn](#output\_ecs\_task\_execution\_role\_arn) | n/a | -| [ecs\_task\_role\_arn](#output\_ecs\_task\_role\_arn) | n/a | -| [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | The ARN of the S3 bucket | -| [s3\_bucket\_ecr\_viewer\_policy\_arn](#output\_s3\_bucket\_ecr\_viewer\_policy\_arn) | n/a | -| [s3\_role\_for\_ecr\_viewer\_arn](#output\_s3\_role\_for\_ecr\_viewer\_arn) | n/a | -| [service\_data](#output\_service\_data) | n/a | - \ No newline at end of file diff --git a/README.md b/README.md index 013b0c1..7517592 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ # Table of Contents -[1. Overview](#1-overview)\ +[1. Overview](#1-overview) [2. Notices](#2-notices) - [Table of Contents](#table-of-contents) - [1. Overview](#1-overview) @@ -145,9 +145,15 @@ No modules. | [aws_iam_role.ecs_task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role.ecs_task_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role.s3_role_for_ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_kms_key.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | +| [aws_kms_key.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | | [aws_s3_bucket.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_policy.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | | [aws_s3_bucket_public_access_block.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [aws_s3_bucket_public_access_block.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | | [aws_s3_bucket_server_side_encryption_configuration.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | +| [aws_s3_bucket_server_side_encryption_configuration.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | | [aws_s3_bucket_versioning.ecr_viewer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | | [aws_security_group.alb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | | [aws_security_group.ecs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | @@ -165,10 +171,12 @@ No modules. | [random_string.s3_viewer](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_ecr_authorization_token.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | +| [aws_elb_service_account.elb_account_id](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source | | [aws_iam_policy.amazon_ec2_container_service_for_ec2_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | | [aws_iam_policy.ecs_task_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.ecr_viewer_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_route_table.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route_table) | data source | ## Inputs @@ -195,6 +203,7 @@ No modules. | [ecs\_cluster\_name](#input\_ecs\_cluster\_name) | Name of the ECS Cluster | `string` | `""` | no | | [ecs\_task\_execution\_role\_name](#input\_ecs\_task\_execution\_role\_name) | Name of the ECS Task Execution Role | `string` | `""` | no | | [ecs\_task\_role\_name](#input\_ecs\_task\_role\_name) | Name of the ECS Task Role | `string` | `""` | no | +| [enable\_alb\_logs](#input\_enable\_alb\_logs) | Flag to enable ALB access and connection logging to s3 logging bucket | `bool` | `true` | no | | [enable\_autoscaling](#input\_enable\_autoscaling) | Flag to enable autoscaling for the ECS services | `bool` | `true` | no | | [internal](#input\_internal) | Flag to determine if the several AWS resources are public (intended for external access, public internet) or private (only intended to be accessed within your AWS VPC or avaiable with other means, a transit gateway for example). | `bool` | `true` | no | | [override\_autoscaling](#input\_override\_autoscaling) | Autoscaling configuration for the DIBBS services | 
map(object({
    cpu           = number
    memory        = number
    min_capacity  = number
    max_capacity  = number
    target_cpu    = number
    target_memory = number
  }))
| `{}` | no | @@ -204,6 +213,7 @@ No modules. | [project](#input\_project) | The project name | `string` | `"dibbs"` | no | | [public\_subnet\_ids](#input\_public\_subnet\_ids) | List of public subnet IDs | `list(string)` | n/a | yes | | [region](#input\_region) | The AWS region where resources are created | `string` | n/a | yes | +| [s3\_logging\_bucket\_name](#input\_s3\_logging\_bucket\_name) | Name of the S3 bucket for logging | `string` | `""` | no | | [s3\_viewer\_bucket\_name](#input\_s3\_viewer\_bucket\_name) | Name of the S3 bucket for the viewer | `string` | `""` | no | | [s3\_viewer\_bucket\_role\_name](#input\_s3\_viewer\_bucket\_role\_name) | Name of the IAM role for the ecr-viewer bucket | `string` | `""` | no | | [secrets\_manager\_auth\_client\_secret\_version](#input\_secrets\_manager\_auth\_client\_secret\_version) | The secret containing the auth client secret. This is the secret that comes from the authentication provider. | `string` | `""` | no | diff --git a/_data.tf b/_data.tf index ac9b6c9..b1203d3 100644 --- a/_data.tf +++ b/_data.tf @@ -1,4 +1,5 @@ data "aws_caller_identity" "current" {} +data "aws_elb_service_account" "elb_account_id" {} data "aws_iam_policy_document" "assume_role" { statement { @@ -27,6 +28,49 @@ data "aws_iam_policy_document" "ecr_viewer_s3" { } } +data "aws_iam_policy_document" "logging" { + statement { + effect = "Allow" + resources = [ + "arn:aws:s3:::${aws_s3_bucket.logging.bucket}/access-logs/AWSLogs/${data.aws_caller_identity.current.account_id}/*", + "arn:aws:s3:::${aws_s3_bucket.logging.bucket}/connection-logs/AWSLogs/${data.aws_caller_identity.current.account_id}/*", + ] + actions = ["s3:PutObject"] + principals { + type = "AWS" + identifiers = ["arn:aws:iam::${data.aws_elb_service_account.elb_account_id.id}:root"] + } + } + statement { + effect = "Allow" + resources = [ + "arn:aws:s3:::${aws_s3_bucket.logging.bucket}/access-logs/AWSLogs/${data.aws_caller_identity.current.account_id}/*", + "arn:aws:s3:::${aws_s3_bucket.logging.bucket}/connection-logs/AWSLogs/${data.aws_caller_identity.current.account_id}/*", + ] + actions = ["s3:PutObject"] + principals { + type = "Service" + identifiers = ["delivery.logs.amazonaws.com"] + } + condition { + test = "StringEquals" + variable = "s3:x-amz-acl" + values = ["bucket-owner-full-control"] + } + } + statement { + effect = "Allow" + resources = [ + "arn:aws:s3:::${aws_s3_bucket.logging.bucket}", + ] + actions = ["s3:GetBucketAcl"] + principals { + type = "Service" + identifiers = ["delivery.logs.amazonaws.com"] + } + } +} + data "aws_iam_policy" "ecs_task_execution" { name = "AmazonECSTaskExecutionRolePolicy" } diff --git a/_local.tf b/_local.tf index 256a26e..e35bc39 100644 --- a/_local.tf +++ b/_local.tf @@ -266,6 +266,7 @@ locals { ecs_cloudwatch_group = var.ecs_cloudwatch_group == "" ? "/${local.local_name}" : var.ecs_cloudwatch_group ecs_cluster_name = var.ecs_cluster_name == "" ? local.local_name : var.ecs_cluster_name s3_viewer_bucket_name = var.s3_viewer_bucket_name == "" ? "${local.local_name}-${random_string.s3_viewer.result}" : var.s3_viewer_bucket_name + s3_logging_bucket_name = var.s3_logging_bucket_name == "" ? "${local.local_name}-${random_string.s3_viewer.result}-logging" : var.s3_logging_bucket_name s3_viewer_bucket_role_name = var.s3_viewer_bucket_role_name == "" ? "${local.local_name}-ecrv" : var.s3_viewer_bucket_role_name tags = var.tags vpc_endpoints = [ diff --git a/_variable.tf b/_variable.tf index e5ca151..4d2f329 100644 --- a/_variable.tf +++ b/_variable.tf @@ -64,6 +64,12 @@ variable "enable_autoscaling" { default = true } +variable "enable_alb_logs" { + type = bool + description = "Flag to enable ALB access and connection logging to s3 logging bucket" + default = true +} + variable "private_subnet_ids" { type = list(string) description = "List of private subnet IDs" @@ -91,6 +97,11 @@ variable "s3_viewer_bucket_role_name" { default = "" } +variable "s3_logging_bucket_name" { + type = string + description = "Name of the S3 bucket for logging" + default = "" +} variable "phdi_version" { type = string description = "Version of the PHDI application" diff --git a/alb.tf b/alb.tf index eb14c34..262cbe1 100644 --- a/alb.tf +++ b/alb.tf @@ -8,6 +8,18 @@ resource "aws_alb" "ecs" { enable_deletion_protection = false + access_logs { + enabled = var.enable_alb_logs + bucket = aws_s3_bucket.logging.id + prefix = "access-logs" + } + + connection_logs { + enabled = var.enable_alb_logs + bucket = aws_s3_bucket.logging.id + prefix = "connection-logs" + } + tags = local.tags } @@ -281,4 +293,4 @@ resource "aws_security_group_rule" "alb_egress" { description = "Allow outbound traffic from alb" security_group_id = aws_security_group.alb.id cidr_blocks = ["0.0.0.0/0"] -} \ No newline at end of file +} diff --git a/ecs.tf b/ecs.tf index 2966793..b69e12d 100644 --- a/ecs.tf +++ b/ecs.tf @@ -57,6 +57,8 @@ resource "aws_ecs_service" "this" { deployment_minimum_healthy_percent = 50 deployment_maximum_percent = 200 + health_check_grace_period_seconds = 120 + deployment_circuit_breaker { enable = true rollback = true diff --git a/iam.tf b/iam.tf index 8ed0032..e6a79c2 100644 --- a/iam.tf +++ b/iam.tf @@ -28,7 +28,7 @@ resource "aws_iam_role" "s3_role_for_ecr_viewer" { assume_role_policy = data.aws_iam_policy_document.assume_role.json tags = local.tags } -# s3 + resource "aws_iam_policy" "s3_bucket_ecr_viewer" { name = "${local.s3_viewer_bucket_role_name}-policy" description = "Policy for ECR-Viewer and S3 for DIBBS-AWS" diff --git a/s3.tf b/s3.tf index f47b46c..6f538dc 100644 --- a/s3.tf +++ b/s3.tf @@ -1,3 +1,11 @@ +resource "aws_kms_key" "ecr_viewer" { + enable_key_rotation = true +} + +resource "aws_kms_key" "logging" { + enable_key_rotation = true +} + resource "aws_s3_bucket" "ecr_viewer" { bucket = local.s3_viewer_bucket_name force_destroy = true @@ -12,13 +20,12 @@ resource "aws_s3_bucket_public_access_block" "ecr_viewer" { restrict_public_buckets = true } -# https://avd.aquasec.com/misconfig/aws/s3/avd-aws-0132/ -# trivy:ignore:AVD-AWS-0132 resource "aws_s3_bucket_server_side_encryption_configuration" "ecr_viewer" { bucket = aws_s3_bucket.ecr_viewer.bucket rule { apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" + kms_master_key_id = aws_kms_key.ecr_viewer.arn + sse_algorithm = "aws:kms" } } } @@ -28,4 +35,33 @@ resource "aws_s3_bucket_versioning" "ecr_viewer" { versioning_configuration { status = "Enabled" } -} \ No newline at end of file +} + +resource "aws_s3_bucket" "logging" { + bucket = local.s3_logging_bucket_name + force_destroy = true + tags = local.tags +} + +resource "aws_s3_bucket_policy" "logging" { + bucket = aws_s3_bucket.logging.id + policy = data.aws_iam_policy_document.logging.json +} + +resource "aws_s3_bucket_public_access_block" "logging" { + bucket = aws_s3_bucket.logging.id + block_public_acls = true + block_public_policy = true + ignore_public_acls = true + restrict_public_buckets = true +} + +resource "aws_s3_bucket_server_side_encryption_configuration" "logging" { + bucket = aws_s3_bucket.logging.bucket + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = aws_kms_key.logging.arn + sse_algorithm = "aws:kms" + } + } +}