Skip to content

Commit 7f4d053

Browse files
vinayakgautamopsankush-sqops
vinayakgautamops
and
ankush-sqops
authored
Release 3.4.1 (#31) (#32)
* Updated module versions and added comments * Update module versions and VPN storage class * Updated VPN terraform outputs for printing port nubmer * Updated Readme files * Updated karpenter private subnet tag * Updated vpn server lifecycle to ignore ami changes Co-authored-by: ankush-sqops <ankush.upadhyay@squareops.com>
1 parent 1080031 commit 7f4d053

File tree

17 files changed

+144
-55
lines changed

17 files changed

+144
-55
lines changed

‎IAM.md

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ The Policy required to deploy this module is:
2727
"ec2:CreateEgressOnlyInternetGateway",
2828
"ec2:CreateFlowLogs",
2929
"ec2:CreateInternetGateway",
30-
"ec2:CreateKeyPair",
30+
"ec2:CreateIpam",
31+
"ec2:CreateIpamPool",
3132
"ec2:CreateNatGateway",
3233
"ec2:CreateNetworkAcl",
3334
"ec2:CreateNetworkAclEntry",
@@ -37,13 +38,15 @@ The Policy required to deploy this module is:
3738
"ec2:CreateSubnet",
3839
"ec2:CreateTags",
3940
"ec2:CreateVPC",
41+
"ec2:CreateVpcEndpoint",
4042
"ec2:CreateVpnGateway",
4143
"ec2:DeleteCustomerGateway",
4244
"ec2:DeleteDhcpOptions",
4345
"ec2:DeleteEgressOnlyInternetGateway",
4446
"ec2:DeleteFlowLogs",
4547
"ec2:DeleteInternetGateway",
46-
"ec2:DeleteKeyPair",
48+
"ec2:DeleteIpam",
49+
"ec2:DeleteIpamPool",
4750
"ec2:DeleteNatGateway",
4851
"ec2:DeleteNetworkAcl",
4952
"ec2:DeleteNetworkAclEntry",
@@ -53,29 +56,35 @@ The Policy required to deploy this module is:
5356
"ec2:DeleteSubnet",
5457
"ec2:DeleteTags",
5558
"ec2:DeleteVPC",
59+
"ec2:DeleteVpcEndpoints",
5660
"ec2:DeleteVpnGateway",
5761
"ec2:DescribeAccountAttributes",
5862
"ec2:DescribeAddresses",
63+
"ec2:DescribeAvailabilityZones",
5964
"ec2:DescribeCustomerGateways",
6065
"ec2:DescribeDhcpOptions",
6166
"ec2:DescribeEgressOnlyInternetGateways",
6267
"ec2:DescribeFlowLogs",
68+
"ec2:DescribeImages",
6369
"ec2:DescribeInstanceAttribute",
6470
"ec2:DescribeInstanceCreditSpecifications",
6571
"ec2:DescribeInstanceTypes",
6672
"ec2:DescribeInstances",
6773
"ec2:DescribeInternetGateways",
68-
"ec2:DescribeKeyPairs",
74+
"ec2:DescribeIpamPools",
75+
"ec2:DescribeIpams",
6976
"ec2:DescribeNatGateways",
7077
"ec2:DescribeNetworkAcls",
7178
"ec2:DescribeNetworkInterfaces",
79+
"ec2:DescribePrefixLists",
7280
"ec2:DescribeRouteTables",
7381
"ec2:DescribeSecurityGroups",
7482
"ec2:DescribeSpotInstanceRequests",
7583
"ec2:DescribeSubnets",
7684
"ec2:DescribeTags",
7785
"ec2:DescribeVolumes",
7886
"ec2:DescribeVpcAttribute",
87+
"ec2:DescribeVpcEndpoints",
7988
"ec2:DescribeVpcs",
8089
"ec2:DescribeVpnGateways",
8190
"ec2:DetachInternetGateway",
@@ -85,9 +94,13 @@ The Policy required to deploy this module is:
8594
"ec2:DisassociateRouteTable",
8695
"ec2:DisassociateVpcCidrBlock",
8796
"ec2:EnableVgwRoutePropagation",
88-
"ec2:ImportKeyPair",
97+
"ec2:GetIpamPoolCidrs",
8998
"ec2:ModifyInstanceAttribute",
99+
"ec2:ModifyIpam",
100+
"ec2:ModifyIpamPool",
101+
"ec2:ModifyVpcEndpoint",
90102
"ec2:MonitorInstances",
103+
"ec2:ProvisionIpamPoolCidr",
91104
"ec2:ReleaseAddress",
92105
"ec2:RequestSpotInstances",
93106
"ec2:RevokeSecurityGroupEgress",
@@ -122,25 +135,35 @@ The Policy required to deploy this module is:
122135
"Sid": "VisualEditor2",
123136
"Effect": "Allow",
124137
"Action": [
138+
"iam:AddRoleToInstanceProfile",
125139
"iam:AttachRolePolicy",
140+
"iam:CreateInstanceProfile",
126141
"iam:CreatePolicy",
127142
"iam:CreateRole",
143+
"iam:CreateServiceLinkedRole",
144+
"iam:DeleteInstanceProfile",
128145
"iam:DeletePolicy",
129146
"iam:DeleteRole",
130147
"iam:DeleteRolePermissionsBoundary",
131148
"iam:DetachRolePolicy",
149+
"iam:GetInstanceProfile",
132150
"iam:GetPolicy",
133151
"iam:GetPolicyVersion",
134152
"iam:GetRole",
135153
"iam:ListAttachedRolePolicies",
136154
"iam:ListInstanceProfilesForRole",
155+
"iam:ListPolicies",
137156
"iam:ListPolicyVersions",
138157
"iam:ListRolePolicies",
139158
"iam:PassRole",
140159
"iam:PutRolePermissionsBoundary",
160+
"iam:RemoveRoleFromInstanceProfile",
161+
"iam:TagInstanceProfile",
141162
"iam:TagPolicy",
142163
"iam:TagRole",
143-
"iam:UntagPolicy"
164+
"iam:UntagInstanceProfile",
165+
"iam:UntagPolicy",
166+
"iam:UpdateRoleDescription"
144167
],
145168
"Resource": [
146169
"*"
@@ -209,13 +232,13 @@ The Policy required to deploy this module is:
209232
"Sid": "VisualEditor7",
210233
"Effect": "Allow",
211234
"Action": [
212-
"ssm:AddTagsToResource",
213-
"ssm:DeleteParameter",
214-
"ssm:DescribeParameters",
235+
"ssm:CreateDocument",
236+
"ssm:DeleteDocument",
237+
"ssm:DescribeDocument",
238+
"ssm:DescribeDocumentPermission",
239+
"ssm:GetDocument",
215240
"ssm:GetParameter",
216-
"ssm:GetParameters",
217-
"ssm:ListTagsForResource",
218-
"ssm:PutParameter"
241+
"ssm:UpdateDocument"
219242
],
220243
"Resource": [
221244
"*"

‎README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
203203

204204
| Name | Source | Version |
205205
|------|--------|---------|
206-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.2.0 |
206+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.9.0 |
207207
| <a name="module_vpn_server"></a> [vpn\_server](#module\_vpn\_server) | ./modules/vpn | n/a |
208208

209209
## Resources
@@ -248,6 +248,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
248248
| <a name="input_ipv4_netmask_length"></a> [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | The netmask length for IPAM managed VPC | `number` | `16` | no |
249249
| <a name="input_ipv6_enabled"></a> [ipv6\_enabled](#input\_ipv6\_enabled) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. | `bool` | `false` | no |
250250
| <a name="input_ipv6_only"></a> [ipv6\_only](#input\_ipv6\_only) | Enable it for deploying native IPv6 network | `bool` | `false` | no |
251+
| <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | ARN of the KMS key to encrypt VPN server EBS volume | `string` | `""` | no |
251252
| <a name="input_name"></a> [name](#input\_name) | Specify the name of the VPC | `string` | `""` | no |
252253
| <a name="input_one_nat_gateway_per_az"></a> [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Set to true if a NAT Gateway is required per availability zone for Private Subnet Tier | `bool` | `false` | no |
253254
| <a name="input_private_subnet_assign_ipv6_address_on_creation"></a> [private\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_private\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on private subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
@@ -280,6 +281,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
280281
| <a name="output_vpc_ipv6_association_id"></a> [vpc\_ipv6\_association\_id](#output\_vpc\_ipv6\_association\_id) | The association ID for the IPv6 CIDR block |
281282
| <a name="output_vpc_secondary_cidr_blocks"></a> [vpc\_secondary\_cidr\_blocks](#output\_vpc\_secondary\_cidr\_blocks) | List of secondary CIDR blocks of the VPC |
282283
| <a name="output_vpn_host_public_ip"></a> [vpn\_host\_public\_ip](#output\_vpn\_host\_public\_ip) | IP Address of VPN Server |
284+
| <a name="output_vpn_port_description"></a> [vpn\_port\_description](#output\_vpn\_port\_description) | Description of VPN server port |
283285
| <a name="output_vpn_security_group"></a> [vpn\_security\_group](#output\_vpn\_security\_group) | Security Group ID of VPN Server |
284286
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
285287

‎examples/complete-vpc-with-vpn/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ No requirements.
3333

3434
| Name | Source | Version |
3535
|------|--------|---------|
36-
| <a name="module_key_pair_vpn"></a> [key\_pair\_vpn](#module\_key\_pair\_vpn) | squareops/keypair/aws | n/a |
37-
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | n/a |
38-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../../ | n/a |
36+
| <a name="module_key_pair_vpn"></a> [key\_pair\_vpn](#module\_key\_pair\_vpn) | squareops/keypair/aws | 1.0.2 |
37+
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | 3.1.0 |
38+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | squareops/vpc/aws | 3.3.5 |
3939

4040
## Resources
4141

‎examples/complete-vpc-with-vpn/main.tf

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,33 @@
11
locals {
22
name = "vpc"
3-
region = "ap-south-1"
3+
region = "us-west-1"
44
environment = "prod"
55
additional_aws_tags = {
66
Owner = "Organization_Name"
77
Expires = "Never"
88
Department = "Engineering"
99
}
10-
kms_user = null
11-
vpc_cidr = "10.10.0.0/16"
12-
current_identity = data.aws_caller_identity.current.arn
10+
kms_user = null
11+
vpc_cidr = "10.10.0.0/16"
12+
availability_zones = ["us-west-1a", "us-west-1b"]
13+
current_identity = data.aws_caller_identity.current.arn
14+
vpn_server_enabled = true // Set to true, enabling the VPN server within the VPC, which will use the provided key pair for securing VPN connections.
1315
}
1416

1517
data "aws_caller_identity" "current" {}
1618

1719
module "key_pair_vpn" {
1820
source = "squareops/keypair/aws"
21+
version = "1.0.2"
22+
count = local.vpn_server_enabled ? 1 : 0
1923
key_name = format("%s-%s-vpn", local.environment, local.name)
2024
environment = local.environment
2125
ssm_parameter_path = format("%s-%s-vpn", local.environment, local.name)
2226
}
2327

2428
module "kms" {
25-
source = "terraform-aws-modules/kms/aws"
26-
29+
source = "terraform-aws-modules/kms/aws"
30+
version = "3.1.0"
2731
deletion_window_in_days = 7
2832
description = "Symetric Key to Enable Encryption at rest using KMS services."
2933
enable_key_rotation = false
@@ -70,14 +74,16 @@ module "kms" {
7074

7175
module "vpc" {
7276
source = "squareops/vpc/aws"
77+
version = "3.3.5"
7378
name = local.name
7479
region = local.region
7580
vpc_cidr = local.vpc_cidr
7681
environment = local.environment
7782
flow_log_enabled = true
78-
vpn_key_pair_name = module.key_pair_vpn.key_pair_name
79-
availability_zones = ["ap-south-1a", "ap-south-1b"]
80-
vpn_server_enabled = true
83+
vpn_key_pair_name = local.vpn_server_enabled ? module.key_pair_vpn[0].key_pair_name : null
84+
availability_zones = local.availability_zones
85+
vpn_server_enabled = local.vpn_server_enabled
86+
kms_key_arn = module.kms.key_arn
8187
intra_subnet_enabled = true
8288
public_subnet_enabled = true
8389
auto_assign_public_ip = true
@@ -91,4 +97,4 @@ module "vpc" {
9197
flow_log_cloudwatch_log_group_skip_destroy = true
9298
flow_log_cloudwatch_log_group_retention_in_days = 90
9399
flow_log_cloudwatch_log_group_kms_key_arn = module.kms.key_arn #Enter your kms key arn
94-
}
100+
}

‎examples/simple-vpc/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,16 @@ locals {
77
Expires = "Never"
88
Department = "Engineering"
99
}
10-
vpc_cidr = "10.10.0.0/16"
10+
vpc_cidr = "10.10.0.0/16"
11+
availability_zones = ["us-east-1a", "us-east-1b"]
1112
}
1213

1314
module "vpc" {
1415
source = "squareops/vpc/aws"
1516
name = local.name
1617
vpc_cidr = local.vpc_cidr
1718
environment = local.environment
18-
availability_zones = ["us-east-1a", "us-east-1b"]
19+
availability_zones = local.availability_zones
1920
public_subnet_enabled = true
2021
auto_assign_public_ip = true
2122
}

‎examples/vpc-dualstack/main.tf

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,17 @@ locals {
77
Expires = "Never"
88
Department = "Engineering"
99
}
10-
vpc_cidr = "10.10.0.0/16"
11-
ipv6_enabled = true
10+
vpc_cidr = "10.10.0.0/16"
11+
availability_zones = ["us-east-1a", "us-east-1b"]
12+
ipv6_enabled = true
1213
}
1314

1415
module "vpc" {
1516
source = "squareops/vpc/aws"
1617
name = local.name
1718
vpc_cidr = local.vpc_cidr
1819
environment = local.environment
19-
availability_zones = ["us-east-1a", "us-east-1b"]
20+
availability_zones = local.availability_zones
2021
public_subnet_enabled = true
2122
private_subnet_enabled = true
2223
intra_subnet_enabled = false

‎examples/vpc-native-ipv6/main.tf

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,10 @@ locals {
77
Expires = "Never"
88
Department = "Engineering"
99
}
10-
vpc_cidr = "10.10.0.0/16"
11-
ipv6_enabled = true
12-
ipv6_only = true
10+
vpc_cidr = "10.10.0.0/16"
11+
availability_zones = ["us-east-1a", "us-east-1b"]
12+
ipv6_enabled = true
13+
ipv6_only = true
1314
}
1415

1516
module "vpc" {
@@ -19,7 +20,7 @@ module "vpc" {
1920
ipv6_only = local.ipv6_only
2021
environment = local.environment
2122
ipv6_enabled = local.ipv6_enabled
22-
availability_zones = ["us-east-1a", "us-east-1b"]
23+
availability_zones = local.availability_zones
2324
public_subnet_enabled = true
2425
private_subnet_enabled = true
2526
intra_subnet_enabled = true

‎examples/vpc-with-private-subnet/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,16 @@ locals {
77
Expires = "Never"
88
Department = "Engineering"
99
}
10-
vpc_cidr = "10.10.0.0/16"
10+
vpc_cidr = "10.10.0.0/16"
11+
availability_zones = ["us-east-1a", "us-east-1b"]
1112
}
1213

1314
module "vpc" {
1415
source = "squareops/vpc/aws"
1516
name = local.name
1617
vpc_cidr = local.vpc_cidr
1718
environment = local.environment
18-
availability_zones = ["us-east-1a", "us-east-1b"]
19+
availability_zones = local.availability_zones
1920
public_subnet_enabled = true
2021
private_subnet_enabled = true
2122
auto_assign_public_ip = true

‎examples/vpc-with-secondary-cidr/main.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ locals {
88
Department = "Engineering"
99
}
1010
vpc_cidr = "10.10.0.0/16"
11+
availability_zones = ["us-east-1a", "us-east-1b"]
1112
secondry_cidr_enabled = true
1213
secondary_cidr_blocks = ["10.20.0.0/16"]
1314
}
@@ -17,7 +18,7 @@ module "vpc" {
1718
name = local.name
1819
vpc_cidr = local.vpc_cidr
1920
environment = local.environment
20-
availability_zones = ["us-east-1a", "us-east-1b"]
21+
availability_zones = local.availability_zones
2122
public_subnet_enabled = true
2223
private_subnet_enabled = true
2324
auto_assign_public_ip = true

0 commit comments

Comments
 (0)