Add support for a log bucket #104
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![bridgecrew[bot]](https://avatars.githubusercontent.com/in/52968?s=60&v=4){kind=small}
| @@ -176,8 +197,8 @@ resource "aws_s3_bucket" "default" { | |||
| dynamic "logging" { | |||
| for_each = var.logging == null ? [] : [1] | |||
| content { | |||
| target_bucket = var.logging["bucket_name"] | |||
| target_prefix = var.logging["prefix"] | |||
| target_bucket = local.logging_bucket_name | |||
There was a problem hiding this comment.
S3 buckets are not encrypted with KMS
Resource: aws_s3_bucket.default | ID: BC_AWS_GENERAL_56
How to Fix
resource "aws_s3_bucket" "mybucket" {
...
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
kms_master_key_id = aws_kms_key.mykey.arn
+ sse_algorithm = "aws:kms"
}
}
}
}Description
TBADependent Resources
| Path | Resource | Connecting Attribute |
|---|---|---|
| /main.tf | aws_s3_bucket_public_access_block.default | bucket |
There was a problem hiding this comment.
Not sure why this is being spammed every few hours... we should add kms encryption here as an option or default but maybe in a separate PR
Created this ticket for future ref: #105
main.tf
Outdated
| @@ -228,7 +249,7 @@ resource "aws_dynamodb_table" "with_server_side_encryption" { | |||
| } | |||
|
|
|||
| resource "aws_dynamodb_table" "without_server_side_encryption" { | |||
| count = local.dynamodb_enabled && ! var.enable_server_side_encryption ? 1 : 0 | |||
| count = local.dynamodb_enabled && !var.enable_server_side_encryption ? 1 : 0 | |||
There was a problem hiding this comment.
Unencrypted DynamoDB Tables
Resource: aws_dynamodb_table.without_server_side_encryption | ID: BC_AWS_GENERAL_52
How to Fix
resource "aws_dynamodb_table" "basic-dynamodb-table" {
...
server_side_encryption {
+ enabled = true
+ kms_key_arn= aws_kms_key.dynamo.arn
}
}Description
Checks if the Amazon DynamoDB tables are encrypted, and in line with AWS best security practice - with a specified non-default KMS key.
main.tf
Outdated
| @@ -228,7 +249,7 @@ resource "aws_dynamodb_table" "with_server_side_encryption" { | |||
| } | |||
|
|
|||
| resource "aws_dynamodb_table" "without_server_side_encryption" { | |||
| count = local.dynamodb_enabled && ! var.enable_server_side_encryption ? 1 : 0 | |||
| count = local.dynamodb_enabled && !var.enable_server_side_encryption ? 1 : 0 | |||
There was a problem hiding this comment.
DynamoDB Tables do not have Auto Scaling enabled
Resource: aws_dynamodb_table.without_server_side_encryption | ID: BC_AWS_GENERAL_44
How to Fix
resource "aws_dynamodb_table" "pass" {
name = "user"
hash_key = "user-id"
billing_mode = "PROVISIONED"
read_capacity = 10
write_capacity = 10
attribute {
name = "user-id"
type = "S"
}
}
resource "aws_appautoscaling_target" "pass" {
resource_id = "table/${aws_dynamodb_table.pass.name}"
scalable_dimension = "dynamodb:table:ReadCapacityUnits"
service_namespace = "dynamodb"
min_capacity = 1
max_capacity = 15
}
resource "aws_appautoscaling_policy" "pass" {
name = "rcu-auto-scaling"
service_namespace = aws_appautoscaling_target.pass.service_namespace
scalable_dimension = aws_appautoscaling_target.pass.scalable_dimension
resource_id = aws_appautoscaling_target.pass.resource_id
policy_type = "TargetTrackingScaling"
target_tracking_scaling_policy_configuration {
predefined_metric_specification {
predefined_metric_type = "RDSReaderAverageCPUUtilization"
predefined_metric_type = "DynamoDBReadCapacityUtilization"
}
// or:
resource "aws_dynamodb_table" "pass_on_demand" {
name = "user"
hash_key = "user-id"
billing_mode = "PAY_PER_REQUEST"
attribute {
name = "user-id"
type = "S"
}
}Description
Checks if DynamoDB tables have autoscaling configuration. Note that for tables with billing_mode = "PAY_PER_REQUEST" such configuration is embedded by default.
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default
nitrocode
reviewed
Nov 1, 2021
main.tf
Outdated
| acl = "log-delivery-write" | ||
| attributes = ["logs"] | ||
| access_log_bucket_prefix = try(var.logging["prefix"], "logs/") | ||
| standard_transition_days = 30 |
There was a problem hiding this comment.
please expose these as input variables as they meet need to be configured based on design decisions
There was a problem hiding this comment.
Exposed those 3, but further customization would be done outside of this module so we don't copy all vars into it.
See bb20c72.
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default
|
/test all |
main.tf
Outdated
| @@ -228,7 +252,7 @@ resource "aws_dynamodb_table" "with_server_side_encryption" { | |||
| } | |||
|
|
|||
| resource "aws_dynamodb_table" "without_server_side_encryption" { | |||
| count = local.dynamodb_enabled && ! var.enable_server_side_encryption ? 1 : 0 | |||
| count = local.dynamodb_enabled && !var.enable_server_side_encryption ? 1 : 0 | |||
There was a problem hiding this comment.
Ensure DynamoDB Tables have Auto Scaling enabled
Resource: aws_dynamodb_table.without_server_side_encryption | ID: BC_AWS_GENERAL_44
How to Fix
resource "aws_dynamodb_table" "pass" {
name = "user"
hash_key = "user-id"
billing_mode = "PROVISIONED"
read_capacity = 10
write_capacity = 10
attribute {
name = "user-id"
type = "S"
}
}
resource "aws_appautoscaling_target" "pass" {
resource_id = "table/${aws_dynamodb_table.pass.name}"
scalable_dimension = "dynamodb:table:ReadCapacityUnits"
service_namespace = "dynamodb"
min_capacity = 1
max_capacity = 15
}
resource "aws_appautoscaling_policy" "pass" {
name = "rcu-auto-scaling"
service_namespace = aws_appautoscaling_target.pass.service_namespace
scalable_dimension = aws_appautoscaling_target.pass.scalable_dimension
resource_id = aws_appautoscaling_target.pass.resource_id
policy_type = "TargetTrackingScaling"
target_tracking_scaling_policy_configuration {
predefined_metric_specification {
predefined_metric_type = "RDSReaderAverageCPUUtilization"
predefined_metric_type = "DynamoDBReadCapacityUtilization"
}
// or:
resource "aws_dynamodb_table" "pass_on_demand" {
name = "user"
hash_key = "user-id"
billing_mode = "PAY_PER_REQUEST"
attribute {
name = "user-id"
type = "S"
}
}Description
Checks if DynamoDB tables have autoscaling configuration. Note that for tables with billing_mode = "PAY_PER_REQUEST" such configuration is embedded by default.
main.tf
Outdated
| @@ -228,7 +252,7 @@ resource "aws_dynamodb_table" "with_server_side_encryption" { | |||
| } | |||
|
|
|||
| resource "aws_dynamodb_table" "without_server_side_encryption" { | |||
| count = local.dynamodb_enabled && ! var.enable_server_side_encryption ? 1 : 0 | |||
| count = local.dynamodb_enabled && !var.enable_server_side_encryption ? 1 : 0 | |||
There was a problem hiding this comment.
Ensure DynamoDB tables are encrypted
Resource: aws_dynamodb_table.without_server_side_encryption | ID: BC_AWS_GENERAL_52
How to Fix
resource "aws_dynamodb_table" "basic-dynamodb-table" {
...
server_side_encryption {
+ enabled = true
+ kms_key_arn= aws_kms_key.dynamo.arn
}
}Description
Checks if the Amazon DynamoDB tables are encrypted, and in line with AWS best security practice - with a specified non-default KMS key.
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default BC_AWS_GENERAL_44 Added /main.tf aws_dynamodb_table.without_server_side_encryption BC_AWS_GENERAL_52 Added /main.tf aws_dynamodb_table.without_server_side_encryption
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default
|
/test all |
|
/test all |
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default BC_AWS_GENERAL_44 Added /main.tf aws_dynamodb_table.without_server_side_encryption BC_AWS_GENERAL_52 Added /main.tf aws_dynamodb_table.without_server_side_encryption
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default
max-lobur
previously approved these changes
Nov 4, 2021
nitrocode
reviewed
Nov 4, 2021
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_GENERAL_56 Added /main.tf aws_s3_bucket.default
|
/test all |
nitrocode
approved these changes
Nov 6, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
what
why
references
N/A