security fixes

AlexanderWiechert · AlexanderWiechert · commit 118697ab24d5 · 2023-08-09T14:24:26.000+02:00
diff --git a/cloudwatch.tf b/cloudwatch.tf
@@ -5,6 +5,7 @@
 resource "aws_cloudwatch_log_group" "fargate_cluster" {
   name              = var.log_group
   retention_in_days = var.log_retention_days
+  kms_key_id        = aws_kms_key.fargate.key_id
 }
 
 
@@ -13,4 +14,9 @@ resource "aws_cloudwatch_log_group" "fargate_execute_command_logs" {
 
   name              = "${var.log_group}-execute-commands"
   retention_in_days = var.log_retention_days
+  kms_key_id        = aws_kms_key.fargate.key_id
 }
+
+resource "aws_kms_key" "fargate" {
+  description             = "cloudwatch-encrpytion"
+}
diff --git a/ecs.tf b/ecs.tf
@@ -5,6 +5,11 @@
 resource "aws_ecs_cluster" "fargate_cluster" {
   name = var.cluster_name
 
+  setting {
+    name  = "containerInsights"
+    value = "enabled"
+  }
+
   dynamic "configuration" {
     for_each = var.enable_execute_command ? [""] : []
     content {
diff --git a/vars.tf b/vars.tf
@@ -11,7 +11,7 @@ variable "execution_role_policy" {
 }
 
 variable "log_retention_days" {
-  default = 0
+  default = 14
 }
 
 variable "enable_execute_command" {

Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,7 @@`
`5`	`5`	`resource "aws_cloudwatch_log_group" "fargate_cluster" {`
`6`	`6`	`name = var.log_group`
`7`	`7`	`retention_in_days = var.log_retention_days`
	`8`	`+ kms_key_id = aws_kms_key.fargate.key_id`
`8`	`9`	`}`
`9`	`10`
`10`	`11`
`@@ -13,4 +14,9 @@ resource "aws_cloudwatch_log_group" "fargate_execute_command_logs" {`
`13`	`14`
`14`	`15`	`name = "${var.log_group}-execute-commands"`
`15`	`16`	`retention_in_days = var.log_retention_days`
	`17`	`+ kms_key_id = aws_kms_key.fargate.key_id`
`16`	`18`	`}`
	`19`	`+`
	`20`	`+resource "aws_kms_key" "fargate" {`
	`21`	`+ description = "cloudwatch-encrpytion"`
	`22`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ variable "execution_role_policy" {`
`11`	`11`	`}`
`12`	`12`
`13`	`13`	`variable "log_retention_days" {`
`14`		`- default = 0`
	`14`	`+ default = 14`
`15`	`15`	`}`
`16`	`16`
`17`	`17`	`variable "enable_execute_command" {`