feat: add ECR enhanced scanning and fix S3 logging configuration

README.md

@@ -135,6 +135,7 @@ No modules.
 | [aws_appmesh_virtual_node.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appmesh_virtual_node) | resource |
 | [aws_cloudwatch_log_group.ecs_cloudwatch_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
 | [aws_ecr_lifecycle_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_lifecycle_policy) | resource |
+| [aws_ecr_registry_scanning_configuration.configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_registry_scanning_configuration) | resource |
 | [aws_ecr_repository.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource |
 | [aws_ecs_cluster.dibbs_app_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
 | [aws_ecs_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
@@ -241,6 +242,7 @@ No modules.
 | <a name="input_enable_alb_logs"></a> [enable\_alb\_logs](#input\_enable\_alb\_logs) | Flag to enable ALB access and connection logging to s3 logging bucket | `bool` | `true` | no |
 | <a name="input_enable_autoscaling"></a> [enable\_autoscaling](#input\_enable\_autoscaling) | Flag to enable autoscaling for the ECS services | `bool` | `true` | no |
 | <a name="input_enable_ecr_viewer_sns_topic"></a> [enable\_ecr\_viewer\_sns\_topic](#input\_enable\_ecr\_viewer\_sns\_topic) | Enable ECR Viewer bucket SNS topic | `bool` | `true` | no |
+| <a name="input_enable_enhanced_ecr_registry_scanning"></a> [enable\_enhanced\_ecr\_registry\_scanning](#input\_enable\_enhanced\_ecr\_registry\_scanning) | Flag to enable enhanced ecr registry scanning, defaults to false | `bool` | `false` | no |
 | <a name="input_enable_logging_sns_topic"></a> [enable\_logging\_sns\_topic](#input\_enable\_logging\_sns\_topic) | Enable logging bucket SNS topic | `bool` | `true` | no |
 | <a name="input_internal"></a> [internal](#input\_internal) | Flag to determine if the several AWS resources are public (intended for external access, public internet) or private (only intended to be accessed within your AWS VPC or avaiable with other means, a transit gateway for example). | `bool` | `true` | no |
 | <a name="input_logging_bucket_lifecycle_configuration"></a> [logging\_bucket\_lifecycle\_configuration](#input\_logging\_bucket\_lifecycle\_configuration) | S3 lifecycle rules | <pre>list(object({<br>    status                             = string<br>    prefix                             = string<br>    abort_incomplete_upload_after_days = number<br>    expiration_days                    = number<br>    transitions = list(object({<br>      days          = number<br>      storage_class = string<br>    }))<br>  }))</pre> | <pre>[<br>  {<br>    "abort_incomplete_upload_after_days": 3,<br>    "expiration_days": 365,<br>    "prefix": "/",<br>    "status": "Enabled",<br>    "transitions": [<br>      {<br>        "days": 0,<br>        "storage_class": "INTELLIGENT_TIERING"<br>      }<br>    ]<br>  }<br>]</pre> | no |

_data.tf

@@ -105,12 +105,12 @@ data "aws_iam_policy_document" "kms" {
 }
 
 data "aws_iam_policy_document" "s3_logging" {
-  # ALB must have s3:PutObjectAcl to write access logs
   statement {
+    sid     = "AllowALBAccess"
     effect  = "Allow"
-    actions = ["s3:PutObject", "s3:PutObjectAcl"]
+    actions = ["s3:PutObject"]
     resources = [
-      "arn:aws:s3:::${aws_s3_bucket.logging.bucket}/AWSLogs/${data.aws_caller_identity.current.account_id}/*",
+      "${aws_s3_bucket.logging.arn}/*"
     ]
     principals {
       type        = "AWS"
@@ -122,8 +122,8 @@ data "aws_iam_policy_document" "s3_logging" {
     effect  = "Deny"
     actions = ["s3:*"]
     resources = [
-      "arn:aws:s3:::${aws_s3_bucket.logging.bucket}",
-      "arn:aws:s3:::${aws_s3_bucket.logging.bucket}/*",
+      aws_s3_bucket.logging.arn,
+      "${aws_s3_bucket.logging.arn}/*",
     ]
     condition {
       test     = "Bool"
@@ -143,8 +143,8 @@ data "aws_iam_policy_document" "ecr_viewer_ssl" {
     effect  = "Deny"
     actions = ["s3:*"]
     resources = [
-      "arn:aws:s3:::${aws_s3_bucket.ecr_viewer.bucket}",
-      "arn:aws:s3:::${aws_s3_bucket.ecr_viewer.bucket}/*",
+      aws_s3_bucket.ecr_viewer.arn,
+      "${aws_s3_bucket.ecr_viewer.arn}/*",
     ]
     condition {
       test     = "Bool"

_variable.tf

@@ -316,6 +316,11 @@ variable "disable_ecr" {
   default     = false
 }
 
+variable "enable_enhanced_ecr_registry_scanning" {
+  type        = bool
+  description = "Flag to enable enhanced ecr registry scanning, defaults to false"
+  default     = false
+}
 variable "tags" {
   type        = map(string)
   description = "Tags to apply to resources"

alb.tf

@@ -19,8 +19,13 @@ resource "aws_alb" "ecs" {
     bucket  = aws_s3_bucket.logging.id
   }
 
-  depends_on = [aws_s3_bucket_policy.logging, aws_s3_bucket.logging]
-  tags       = local.tags
+  depends_on = [
+    aws_s3_bucket_policy.logging,
+    aws_s3_bucket.logging,
+    data.aws_iam_policy_document.s3_logging,
+    aws_s3_bucket_server_side_encryption_configuration.logging,
+  ]
+  tags = local.tags
 }
 
 resource "aws_alb_target_group" "this" {

ecs.tf

@@ -126,5 +126,9 @@ resource "aws_ecs_service" "this" {
     ignore_changes = [desired_count]
   }
 
+  depends_on = [
+    aws_alb.ecs
+  ]
+
   tags = local.tags
 }

enable_ecr.tf

@@ -38,6 +38,19 @@ resource "aws_ecr_repository" "this" {
   tags = local.tags
 }
 
+resource "aws_ecr_registry_scanning_configuration" "configuration" {
+  count     = var.disable_ecr == false && var.enable_enhanced_ecr_registry_scanning == true ? 1 : 0
+  scan_type = "ENHANCED"
+
+  rule {
+    scan_frequency = "SCAN_ON_PUSH"
+    repository_filter {
+      filter      = "*"
+      filter_type = "WILDCARD"
+    }
+  }
+}
+
 resource "aws_ecr_lifecycle_policy" "this" {
   for_each   = var.disable_ecr == false ? local.service_data : {}
   repository = aws_ecr_repository.this[each.key].name

s3.tf

@@ -37,6 +37,7 @@ resource "aws_s3_bucket_policy" "ecr_viewer_ssl" {
 
 resource "aws_s3_bucket" "logging" {
   # checkov:skip=CKV_AWS_144:TODO - Cross-region replication for this bucket to be implemented later
+  # checkov:skip=CKV_AWS_145:ALB logging is not fully compatible with customer managed keys - uses separate encryption config
   bucket        = local.s3_logging_bucket_name
   force_destroy = true
   tags          = local.tags
@@ -55,12 +56,14 @@ resource "aws_s3_bucket_public_access_block" "logging" {
   restrict_public_buckets = true
 }
 
+# checkov:skip=CKV_AWS_145:ALB logging is not fully compatible with customer managed keys
+# trivy:ignore:AVD-AWS-0132
 resource "aws_s3_bucket_server_side_encryption_configuration" "logging" {
   bucket = aws_s3_bucket.logging.bucket
   rule {
+    # CANNOT USER CUSTOMER MANAGED KEYS WITH ALB LOGGING
     apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.ecr_viewer.arn
-      sse_algorithm     = "aws:kms"
+      sse_algorithm = "AES256"
     }
   }
 }