Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for a log bucket #104

Merged
merged 9 commits into from
Nov 6, 2021
Merged

Add support for a log bucket #104

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
54919b4
feat: add support for a log bucket
johncblandii Oct 29, 2021
86797e4
Auto Format
cloudpossebot Nov 1, 2021
bb20c72
chore: add support for log bucket var config
johncblandii Nov 2, 2021
2f34979
Auto Format
cloudpossebot Nov 2, 2021
894cfe2
chore: tighten up the bucket name integration
johncblandii Nov 4, 2021
c77c6d0
Auto Format
cloudpossebot Nov 4, 2021
9e6f25d
chore: fix incorrect local
johncblandii Nov 4, 2021
7372db1
Auto Format
cloudpossebot Nov 4, 2021
e8aaec4
chore: consolidate locals
johncblandii Nov 5, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,7 @@ Available targets:
| Name | Source | Version |
|------|--------|---------|
| <a name="module_dynamodb_table_label"></a> [dynamodb\_table\_label](#module\_dynamodb\_table\_label) | cloudposse/label/null | 0.25.0 |
| <a name="module_log_storage"></a> [log\_storage](#module\_log\_storage) | cloudposse/s3-log-storage/aws | 0.26.0 |
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |

## Resources
Expand Down Expand Up @@ -313,6 +314,10 @@ Available targets:
| <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,<br>set as tag values, and output by this module individually.<br>Does not affect values of tags passed in via the `tags` input.<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.<br>Default value: `lower`. | `string` | `null` | no |
| <a name="input_labels_as_tags"></a> [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.<br>Default is to include all labels.<br>Tags with empty values will not be included in the `tags` output.<br>Set to `[]` to suppress all generated tags.<br>**Notes:**<br> The value of the `name` tag, if included, will be the `id`, not the `name`.<br> Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be<br> changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | <pre>[<br> "default"<br>]</pre> | no |
| <a name="input_logging"></a> [logging](#input\_logging) | Bucket access logging configuration. | <pre>object({<br> bucket_name = string<br> prefix = string<br> })</pre> | `null` | no |
| <a name="input_logging_bucket_enabled"></a> [logging\_bucket\_enabled](#input\_logging\_bucket\_enabled) | Whether to create the s3 access log bucket. | `bool` | `false` | no |
| <a name="input_logging_bucket_expiration_days"></a> [logging\_bucket\_expiration\_days](#input\_logging\_bucket\_expiration\_days) | Whether to create the s3 access log bucket. | `number` | `90` | no |
| <a name="input_logging_bucket_glacier_transition_days"></a> [logging\_bucket\_glacier\_transition\_days](#input\_logging\_bucket\_glacier\_transition\_days) | Whether to create the s3 access log bucket. | `number` | `60` | no |
| <a name="input_logging_bucket_standard_transition_days"></a> [logging\_bucket\_standard\_transition\_days](#input\_logging\_bucket\_standard\_transition\_days) | Whether to create the s3 access log bucket. | `number` | `30` | no |
| <a name="input_mfa_delete"></a> [mfa\_delete](#input\_mfa\_delete) | A boolean that indicates that versions of S3 objects can only be deleted with MFA. ( Terraform cannot apply changes of this value; https://github.com/terraform-providers/terraform-provider-aws/issues/629 ) | `bool` | `false` | no |
| <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
Expand Down
5 changes: 5 additions & 0 deletions docs/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
| Name | Source | Version |
|------|--------|---------|
| <a name="module_dynamodb_table_label"></a> [dynamodb\_table\_label](#module\_dynamodb\_table\_label) | cloudposse/label/null | 0.25.0 |
| <a name="module_log_storage"></a> [log\_storage](#module\_log\_storage) | cloudposse/s3-log-storage/aws | 0.26.0 |
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |

## Resources
Expand Down Expand Up @@ -68,6 +69,10 @@
| <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,<br>set as tag values, and output by this module individually.<br>Does not affect values of tags passed in via the `tags` input.<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.<br>Default value: `lower`. | `string` | `null` | no |
| <a name="input_labels_as_tags"></a> [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.<br>Default is to include all labels.<br>Tags with empty values will not be included in the `tags` output.<br>Set to `[]` to suppress all generated tags.<br>**Notes:**<br> The value of the `name` tag, if included, will be the `id`, not the `name`.<br> Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be<br> changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | <pre>[<br> "default"<br>]</pre> | no |
| <a name="input_logging"></a> [logging](#input\_logging) | Bucket access logging configuration. | <pre>object({<br> bucket_name = string<br> prefix = string<br> })</pre> | `null` | no |
| <a name="input_logging_bucket_enabled"></a> [logging\_bucket\_enabled](#input\_logging\_bucket\_enabled) | Whether to create the s3 access log bucket. | `bool` | `false` | no |
| <a name="input_logging_bucket_expiration_days"></a> [logging\_bucket\_expiration\_days](#input\_logging\_bucket\_expiration\_days) | Whether to create the s3 access log bucket. | `number` | `90` | no |
| <a name="input_logging_bucket_glacier_transition_days"></a> [logging\_bucket\_glacier\_transition\_days](#input\_logging\_bucket\_glacier\_transition\_days) | Whether to create the s3 access log bucket. | `number` | `60` | no |
| <a name="input_logging_bucket_standard_transition_days"></a> [logging\_bucket\_standard\_transition\_days](#input\_logging\_bucket\_standard\_transition\_days) | Whether to create the s3 access log bucket. | `number` | `30` | no |
| <a name="input_mfa_delete"></a> [mfa\_delete](#input\_mfa\_delete) | A boolean that indicates that versions of S3 objects can only be deleted with MFA. ( Terraform cannot apply changes of this value; https://github.com/terraform-providers/terraform-provider-aws/issues/629 ) | `bool` | `false` | no |
| <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
Expand Down
29 changes: 25 additions & 4 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
locals {
enabled = module.this.enabled

bucket_enabled = local.enabled && var.bucket_enabled
dynamodb_enabled = local.enabled && var.dynamodb_enabled
bucket_enabled = local.enabled && var.bucket_enabled
dynamodb_enabled = local.enabled && var.dynamodb_enabled
logging_bucket_enabled = local.bucket_enabled && var.logging_bucket_enabled

dynamodb_table_name = coalesce(var.dynamodb_table_name, module.dynamodb_table_label.id)

Expand Down Expand Up @@ -132,6 +133,26 @@ data "aws_iam_policy_document" "prevent_unencrypted_uploads" {
}
}

module "log_storage" {
source = "cloudposse/s3-log-storage/aws"
version = "0.26.0"

enabled = local.logging_bucket_enabled
acl = "log-delivery-write"
attributes = ["logs"]
access_log_bucket_prefix = try(var.logging["prefix"], "logs/")
standard_transition_days = var.logging_bucket_standard_transition_days
glacier_transition_days = var.logging_bucket_glacier_transition_days
expiration_days = var.logging_bucket_expiration_days

context = module.this.context
}

locals {
logging_bucket_name = local.logging_bucket_enabled ? module.log_storage.bucket_id : var.logging["bucket_name"]
logging_prefix = local.logging_bucket_enabled ? module.log_storage.prefix : var.logging["prefix"]
}

resource "aws_s3_bucket" "default" {
count = local.bucket_enabled ? 1 : 0

Expand Down Expand Up @@ -176,8 +197,8 @@ resource "aws_s3_bucket" "default" {
dynamic "logging" {
for_each = var.logging == null ? [] : [1]
content {
target_bucket = var.logging["bucket_name"]
target_prefix = var.logging["prefix"]
target_bucket = local.logging_bucket_name
Copy link

@bridgecrew bridgecrew bot Nov 1, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   S3 buckets are not encrypted with KMS
    Resource: aws_s3_bucket.default | ID: BC_AWS_GENERAL_56

How to Fix

resource "aws_s3_bucket" "mybucket" {
  ...
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.mykey.arn
 +      sse_algorithm     = "aws:kms"
      }
    }
  }
}

Description

TBA

Dependent Resources



Path Resource Connecting Attribute
/main.tf aws_s3_bucket_public_access_block.default bucket

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure why this is being spammed every few hours... we should add kms encryption here as an option or default but maybe in a separate PR

Created this ticket for future ref: #105

nitrocode marked this conversation as resolved.
Show resolved Hide resolved
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
target_prefix = local.logging_prefix
}
}

Expand Down
24 changes: 24 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,30 @@ variable "logging" {
description = "Bucket access logging configuration."
}

variable "logging_bucket_enabled" {
type = bool
default = false
description = "Whether to create the s3 access log bucket."
}

variable "logging_bucket_standard_transition_days" {
type = number
default = 30
description = "Whether to create the s3 access log bucket."
}

variable "logging_bucket_glacier_transition_days" {
type = number
default = 60
description = "Whether to create the s3 access log bucket."
}

variable "logging_bucket_expiration_days" {
type = number
default = 90
description = "Whether to create the s3 access log bucket."
}

variable "bucket_enabled" {
type = bool
default = true
Expand Down