Merge pull request #137 from ansible-lockdown/devel

Benchmark 1.7 and issue fixes

Author: georgenalen

.ansible-lint

@@ -1,12 +1,20 @@
+---
 parseable: true
 quiet: true
 skip_list:
-  - '204'
-  - '305'
-  - '303'
-  - '403'
-  - '306'
-  - '602'
-  - '208'
+    - 'schema'
+    - 'no-changed-when'
+    - 'var-spacing'
+    - 'fqcn-builtins'
+    - 'experimental'
+    - 'name[casing]'
+    - 'name[template]'
+    - '204'
+    - '305'
+    - '303'
+    - '403'
+    - '306'
+    - '602'
+    - '208'
 use_default_rules: true
 verbosity: 0

.github/workflows/github_networks.tf

@@ -1,11 +1,53 @@
 resource "aws_vpc" "Main" {
   cidr_block = var.main_vpc_cidr
-  tags = var.instance_tags
+  instance_tenancy = "default"
+  tags       = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-VPC"
+    }
 }
 
 resource "aws_internet_gateway" "IGW" {
   vpc_id = aws_vpc.Main.id
   tags = {
-    Name      = "${var.namespace}-IGW"
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-IGW"
   }
 }
+
+resource "aws_subnet" "publicsubnets" {
+  vpc_id =  aws_vpc.Main.id
+  cidr_block = var.public_subnets
+  availability_zone = var.availability_zone
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-pubsub"
+  }
+}
+
+resource "aws_subnet" "Main" {
+  vpc_id =  aws_vpc.Main.id
+  availability_zone = var.availability_zone
+  cidr_block = var.private_subnets
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-prvsub"
+  }
+}
+
+resource "aws_route_table" "PublicRT" {
+   vpc_id =  aws_vpc.Main.id
+   route {
+   cidr_block = "0.0.0.0/0"
+   gateway_id = aws_internet_gateway.IGW.id
+   }
+   tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-publicRT"
+  }
+}
+
+resource "aws_route_table_association" "rt_associate_public" {
+  subnet_id = aws_subnet.Main.id
+  route_table_id = aws_route_table.PublicRT.id
+}

.github/workflows/github_vars.tfvars

@@ -3,10 +3,11 @@
 // Declared in variables.tf
 // 
 
-namespace         = "github_actions"
+namespace = "github_actions"
+environment = "lockdown_github_repo_workflow"
 
 // Matching pair name found in AWS for keypairs PEM key
 ami_key_pair_name = "github_actions"
 main_vpc_cidr     = "172.22.0.0/24"
 public_subnets    = "172.22.0.128/26"
-private_subnets   = "172.22.0.192/26"
+private_subnets   = "172.22.0.192/26"

.github/workflows/linux_benchmark_testing.yml

@@ -1,5 +1,5 @@
 # This is a basic workflow to help you get started with Actions
-
+---
 name: linux_benchmark_pipeline
 
 # Controls when the action will run.
@@ -23,26 +23,26 @@ on:
 jobs:
   # This will create messages for first time contributers and direct them to the Discord server
   welcome:
-      runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
 
-      steps:
-          - uses: actions/first-interaction@v1.1.0
-            with:
-                repo-token: ${{ secrets.GITHUB_TOKEN }}
-                pr-message: |-
-                  Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown! 
-                  Please join in the conversation happening on the [Discord Server](https://discord.gg/JFxpSgPFEJ) as well.
+    steps:
+      - uses: actions/first-interaction@main
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-message: |-
+            Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
+            Please join in the conversation happening on the [Discord Server](https://discord.gg/JFxpSgPFEJ) as well.
   # This workflow contains a single job called "build"
   build:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
 
-    env: 
+    env:
       ENABLE_DEBUG: false
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, 
+      # Checks-out your repository under $GITHUB_WORKSPACE,
       # so your job can access it
       - uses: actions/checkout@v2
         with:
@@ -75,46 +75,37 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         run: terraform apply -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
 
-## Debug Section
+      ## Debug Section
       - name: DEBUG - Show Ansible hostfile
         if: env.ENABLE_DEBUG == 'true'
         working-directory: .github/workflows
         run: cat hosts.yml
 
-# Centos 7 images take a while to come up insert sleep or playbook fails
-
-      - name: Check if test os is rhel7
-        working-directory: .github/workflows
-        id: test_os
-        run: >-
-          echo "::set-output name=RHEL7::$(
-          grep -c RHEL7 OS.tfvars
-          )"
+      # Aws deployments taking a while to come up insert sleep or playbook fails
 
-      - name: if RHEL7 - Sleep for 60 seconds
-        if: steps.test_os.outputs.RHEL7 >= 1
+      - name: Sleep for 60 seconds
         run: sleep 60s
         shell: bash
 
-# Run the ansible playbook
+      # Run the ansible playbook
       - name: Run_Ansible_Playbook
         uses: arillso/action.playbook@master
         with:
           playbook: site.yml
           inventory: .github/workflows/hosts.yml
           galaxy_file: collections/requirements.yml
           private_key: ${{ secrets.SSH_PRV_KEY }}
-#          verbose: 3
+          # verbose: 3
         env:
           ANSIBLE_HOST_KEY_CHECKING: "false"
           ANSIBLE_DEPRECATION_WARNINGS: "false"
 
-# Remove test system - User secrets to keep if necessary
+      # Remove test system - User secrets to keep if necessary
 
       - name: Terraform_Destroy
         working-directory: .github/workflows
         if: always() && env.ENABLE_DEBUG == 'false'
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        run: terraform destroy -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
+        run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false

.github/workflows/main.tf

@@ -5,10 +5,6 @@ provider "aws" {
 
 // Create a security group with access to port 22 and port 80 open to serve HTTP traffic
 
-data "aws_vpc" "default" {
-  default = true
-}
-
 resource "random_id" "server" {
   keepers = {
     # Generate a new id each time we switch to a new AMI id
@@ -19,8 +15,8 @@ resource "random_id" "server" {
 }
 
 resource "aws_security_group" "github_actions" {
-  name   = "${var.namespace}-${random_id.server.hex}"
-  vpc_id = data.aws_vpc.default.id
+  name   = "${var.namespace}-${random_id.server.hex}-SG"
+  vpc_id = aws_vpc.Main.id
 
   ingress {
     from_port   = 22
@@ -43,6 +39,7 @@ resource "aws_security_group" "github_actions" {
     cidr_blocks = ["0.0.0.0/0"]
   }
   tags = {
+    Environment = "${var.environment}"
     Name = "${var.namespace}-SG"
  }
 }
@@ -51,11 +48,13 @@ resource "aws_security_group" "github_actions" {
 
 resource "aws_instance" "testing_vm" {
   ami                         = var.ami_id
+  availability_zone           = var.availability_zone
   associate_public_ip_address = true
   key_name                    = var.ami_key_pair_name # This is the key as known in the ec2 key_pairs
   instance_type               = var.instance_type
   tags                        = var.instance_tags
   vpc_security_group_ids      = [aws_security_group.github_actions.id]
+  subnet_id                   = aws_subnet.Main.id
   root_block_device {
         delete_on_termination = true
   }
@@ -80,4 +79,3 @@ resource "local_file" "inventory" {
         audit_git_version: devel
     EOF
 }
-

.github/workflows/test.sh

@@ -2,5 +2,3 @@ RHEL7=$(grep -c RHEL7 OS.tfvars)
 if [ `echo $?` != 0 ]; then
    exit 0
 fi
-    
-  

.github/workflows/variables.tf

@@ -6,6 +6,12 @@ variable "aws_region" {
   type        = string
 }
 
+variable "availability_zone" {
+  description = "List of availability zone in the region"
+  default     = "us-east-1b"
+  type        = string
+}
+
 variable "instance_type" {
   description = "EC2 Instance Type"
   default     = "t3.micro"
@@ -47,6 +53,11 @@ variable "namespace" {
   type        = string
 }
 
+variable "environment" {
+  description = "Env Name used across all tags"
+  type        = string
+}
+
 // taken from github_vars.tfvars &
 
 variable "main_vpc_cidr" {
@@ -62,4 +73,4 @@ variable "public_subnets" {
 variable "private_subnets" {
   description = "private subnet cidr block"
   type        = string
-}
+}

.yamllint

@@ -14,11 +14,19 @@ rules:
     spaces: 4
     # Requiring consistent indentation within a file, either indented or not
     indent-sequences: consistent
-  truthy: disable
+    level: error
   braces:
     max-spaces-inside: 1
     level: error
   brackets:
     max-spaces-inside: 1
     level: error
   line-length: disable
+  key-duplicates: enable
+  new-line-at-end-of-file: enable
+  new-lines:
+    type: unix
+  trailing-spaces: enable
+  truthy:
+    allowed-values: ['true', 'false']
+    check-keys: false

Makefile

@@ -0,0 +1,11 @@
+# TESTS
+
+all: yamllint
+
+yamllint:
+	git ls-files "*.yml"|xargs yamllint
+
+requirements:
+	@echo 'Python dependencies:'
+	@cat requirements.txt
+	pip install -r requirements.txt

README.md

@@ -6,11 +6,11 @@
 
 Configure a RHEL/Rocky 8 system to be DISA STIG compliant. All findings will be audited by default. Non-disruptive CAT I, CAT II, and CAT III findings will be corrected by default. Disruptive finding remediation can be enabled by setting `rhel8stig_disruption_high` to `yes`.
 
-This role is based on RHEL 8 DISA STIG: [Version 1, Rel 6 released on April 27, 2022](https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_8_V1R6_STIG.zip).
+This role is based on RHEL 8 DISA STIG: [Version 1, Rel 7 released on July 27, 2022](https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_8_V1R7_STIG.zip).
 
 ## Join us
 
-On our [Discord Server](https://discord.gg/JFxpSgPFEJ) to ask questions, discuss features, or just chat with other Ansible-Lockdown users
+On our [Discord Server](https://discord.io/ansible-lockdown) to ask questions, discuss features, or just chat with other Ansible-Lockdown users
 
 ## Updating
 
@@ -45,7 +45,7 @@ Refer to [RHEL8-STIG-Audit](https://github.com/ansible-lockdown/RHEL8-STIG-Audit
   - [Tower User Guide](https://docs.ansible.com/ansible-tower/latest/html/userguide/index.html)
   - [Ansible Community Info](https://docs.ansible.com/ansible/latest/community/index.html)
 - Functioning Ansible and/or Tower Installed, configured, and running. This includes all of the base Ansible/Tower configurations, needed packages installed, and infrastructure setup.
-- Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file or the [Main Variables Wiki Page](https://github.com/ansible-lockdown/RHEL8-STIG/wiki/Main-Variables).
+- Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consequences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file or the [Main Variables Wiki Page](https://github.com/ansible-lockdown/RHEL8-STIG/wiki/Main-Variables).
 
 ## Documentation
 
@@ -149,7 +149,7 @@ uses:
 
 If adopting stig rule RHEL-08-040134
 
-This will affect cloud init as per https://bugs.launchpad.net/cloud-init/+bug/1839899
+This will affect cloud init as per [bug 1839899](https://bugs.launchpad.net/cloud-init/+bug/1839899)
 
 ## Support