Skip to content

Commit c4fd153

Browse files
RohitSquareopsRohitSquareops
authored
Merge pull request #17 from RohitSquareops/release-feature
Release feature for private endpoints and CW log group
2 parents 3509552 + 1ea75d9 commit c4fd153

File tree

5 files changed

+205
-10
lines changed

5 files changed

+205
-10
lines changed

‎README.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,10 @@ module "vpc" {
4040
one_nat_gateway_per_az = true
4141
database_subnet_enabled = true
4242
vpn_server_instance_type = "t3a.small"
43+
vpc_s3_endpoint_enabled = true
44+
vpc_ecr_endpoint_enabled = true
4345
flow_log_max_aggregation_interval = 60
46+
flow_log_cloudwatch_log_group_skip_destroy = true
4447
flow_log_cloudwatch_log_group_retention_in_days = 90
4548
flow_log_cloudwatch_log_group_kms_key_arn = "arn:aws:kms:us-east-2:222222222222:key/kms_key_arn" #Enter your kms key arn
4649
}
@@ -200,18 +203,23 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
200203

201204
| Name | Source | Version |
202205
|------|--------|---------|
203-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.1.1 |
206+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.2.0 |
204207
| <a name="module_vpn_server"></a> [vpn\_server](#module\_vpn\_server) | ./modules/vpn | n/a |
205208

206209
## Resources
207210

208211
| Name | Type |
209212
|------|------|
213+
| [aws_security_group.vpc_endpoints](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
214+
| [aws_vpc_endpoint.private-ecr-api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
215+
| [aws_vpc_endpoint.private-ecr-dkr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
216+
| [aws_vpc_endpoint.private-s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
210217
| [aws_vpc_ipam.ipam](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam) | resource |
211218
| [aws_vpc_ipam_pool.ipam_pool](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_pool) | resource |
212219
| [aws_vpc_ipam_pool_cidr.ipam_pool_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_pool_cidr) | resource |
213220
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
214221
| [aws_ec2_instance_type.arch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_instance_type) | data source |
222+
| [aws_route_tables.aws_private_routes](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route_tables) | data source |
215223

216224
## Inputs
217225

@@ -229,6 +237,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
229237
| <a name="input_existing_ipam_managed_cidr"></a> [existing\_ipam\_managed\_cidr](#input\_existing\_ipam\_managed\_cidr) | The existing IPAM pool CIDR | `string` | `""` | no |
230238
| <a name="input_flow_log_cloudwatch_log_group_kms_key_arn"></a> [flow\_log\_cloudwatch\_log\_group\_kms\_key\_arn](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_arn) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs | `string` | `null` | no |
231239
| <a name="input_flow_log_cloudwatch_log_group_retention_in_days"></a> [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | `null` | no |
240+
| <a name="input_flow_log_cloudwatch_log_group_skip_destroy"></a> [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
232241
| <a name="input_flow_log_enabled"></a> [flow\_log\_enabled](#input\_flow\_log\_enabled) | Whether or not to enable VPC Flow Logs | `bool` | `false` | no |
233242
| <a name="input_flow_log_max_aggregation_interval"></a> [flow\_log\_max\_aggregation\_interval](#input\_flow\_log\_max\_aggregation\_interval) | The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds or `600` seconds. | `number` | `60` | no |
234243
| <a name="input_intra_subnet_assign_ipv6_address_on_creation"></a> [intra\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_intra\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on intra subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
@@ -251,6 +260,8 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
251260
| <a name="input_secondary_cidr_blocks"></a> [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of the secondary CIDR blocks which can be at most 5 | `list(string)` | `[]` | no |
252261
| <a name="input_secondry_cidr_enabled"></a> [secondry\_cidr\_enabled](#input\_secondry\_cidr\_enabled) | Whether enable secondary CIDR with VPC | `bool` | `false` | no |
253262
| <a name="input_vpc_cidr"></a> [vpc\_cidr](#input\_vpc\_cidr) | The CIDR block of the VPC | `string` | `"10.0.0.0/16"` | no |
263+
| <a name="input_vpc_ecr_endpoint_enabled"></a> [vpc\_ecr\_endpoint\_enabled](#input\_vpc\_ecr\_endpoint\_enabled) | Set to true if you want to enable vpc ecr endpoints | `bool` | `false` | no |
264+
| <a name="input_vpc_s3_endpoint_enabled"></a> [vpc\_s3\_endpoint\_enabled](#input\_vpc\_s3\_endpoint\_enabled) | Set to true if you want to enable vpc S3 endpoints | `bool` | `false` | no |
254265
| <a name="input_vpn_key_pair_name"></a> [vpn\_key\_pair\_name](#input\_vpn\_key\_pair\_name) | Specify the name of AWS Keypair to be used for VPN Server | `string` | `""` | no |
255266
| <a name="input_vpn_server_enabled"></a> [vpn\_server\_enabled](#input\_vpn\_server\_enabled) | Set to true if you want to deploy VPN Gateway resource and attach it to the VPC | `bool` | `false` | no |
256267
| <a name="input_vpn_server_instance_type"></a> [vpn\_server\_instance\_type](#input\_vpn\_server\_instance\_type) | EC2 instance Type for VPN Server, Only amd64 based instance type are supported eg. t2.medium, t3.micro, c5a.large etc. | `string` | `"t3a.small"` | no |

‎examples/complete-vpc-with-vpn/README.md

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,23 @@ No requirements.
2525

2626
## Providers
2727

28-
No providers.
28+
| Name | Version |
29+
|------|---------|
30+
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
2931

3032
## Modules
3133

3234
| Name | Source | Version |
3335
|------|--------|---------|
3436
| <a name="module_key_pair_vpn"></a> [key\_pair\_vpn](#module\_key\_pair\_vpn) | squareops/keypair/aws | n/a |
35-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | squareops/vpc/aws | n/a |
37+
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | n/a |
38+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../../ | n/a |
3639

3740
## Resources
3841

39-
No resources.
42+
| Name | Type |
43+
|------|------|
44+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
4045

4146
## Inputs
4247

‎examples/complete-vpc-with-vpn/main.tf

Lines changed: 60 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,76 @@ locals {
77
Expires = "Never"
88
Department = "Engineering"
99
}
10-
vpc_cidr = "10.10.0.0/16"
10+
kms_user = null
11+
vpc_cidr = "10.10.0.0/16"
12+
current_identity = data.aws_caller_identity.current.arn
1113
}
1214

15+
data "aws_caller_identity" "current" {}
16+
1317
module "key_pair_vpn" {
1418
source = "squareops/keypair/aws"
1519
key_name = format("%s-%s-vpn", local.environment, local.name)
1620
environment = local.environment
1721
ssm_parameter_path = format("%s-%s-vpn", local.environment, local.name)
1822
}
1923

24+
module "kms" {
25+
source = "terraform-aws-modules/kms/aws"
26+
27+
deletion_window_in_days = 7
28+
description = "Symetric Key to Enable Encryption at rest using KMS services."
29+
enable_key_rotation = false
30+
is_enabled = true
31+
key_usage = "ENCRYPT_DECRYPT"
32+
multi_region = false
33+
34+
# Policy
35+
enable_default_policy = true
36+
key_owners = [local.current_identity]
37+
key_administrators = local.kms_user == null ? ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
38+
key_users = local.kms_user == null ? ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
39+
key_service_users = local.kms_user == null ? ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
40+
key_symmetric_encryption_users = [local.current_identity]
41+
key_hmac_users = [local.current_identity]
42+
key_asymmetric_public_encryption_users = [local.current_identity]
43+
key_asymmetric_sign_verify_users = [local.current_identity]
44+
key_statements = [
45+
{
46+
sid = "AllowCloudWatchLogsEncryption",
47+
effect = "Allow"
48+
actions = [
49+
"kms:Encrypt*",
50+
"kms:Decrypt*",
51+
"kms:ReEncrypt*",
52+
"kms:GenerateDataKey*",
53+
"kms:Describe*"
54+
]
55+
resources = ["*"]
56+
57+
principals = [
58+
{
59+
type = "Service"
60+
identifiers = ["logs.${local.region}.amazonaws.com"]
61+
}
62+
]
63+
}
64+
]
65+
# Aliases
66+
aliases = ["${local.name}-KMS"]
67+
aliases_use_name_prefix = true
68+
}
69+
70+
2071
module "vpc" {
2172
source = "squareops/vpc/aws"
2273
name = local.name
74+
region = local.region
2375
vpc_cidr = local.vpc_cidr
2476
environment = local.environment
25-
flow_log_enabled = false
77+
flow_log_enabled = true
2678
vpn_key_pair_name = module.key_pair_vpn.key_pair_name
27-
availability_zones = ["us-east-1a", "us-east-1b"]
79+
availability_zones = ["ap-south-1a", "ap-south-1b"]
2880
vpn_server_enabled = true
2981
intra_subnet_enabled = true
3082
public_subnet_enabled = true
@@ -33,7 +85,10 @@ module "vpc" {
3385
one_nat_gateway_per_az = true
3486
database_subnet_enabled = true
3587
vpn_server_instance_type = "t3a.small"
36-
flow_log_max_aggregation_interval = 60
88+
vpc_s3_endpoint_enabled = true
89+
vpc_ecr_endpoint_enabled = true
90+
flow_log_max_aggregation_interval = 60 # In seconds
91+
flow_log_cloudwatch_log_group_skip_destroy = true
3792
flow_log_cloudwatch_log_group_retention_in_days = 90
38-
flow_log_cloudwatch_log_group_kms_key_arn = "arn:aws:kms:us-east-2:222222222222:key/kms_key_arn" #Enter your kms key arn
93+
flow_log_cloudwatch_log_group_kms_key_arn = module.kms.key_arn #Enter your kms key arn
3994
}

‎main.tf

Lines changed: 107 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ data "aws_ec2_instance_type" "arch" {
6161

6262
module "vpc" {
6363
source = "terraform-aws-modules/vpc/aws"
64-
version = "5.1.1"
64+
version = "5.2.0"
6565
name = format("%s-%s-vpc", var.environment, var.name)
6666
cidr = var.vpc_cidr # CIDR FOR VPC
6767
azs = [for n in range(0, local.azs) : data.aws_availability_zones.available.names[n]]
@@ -93,6 +93,7 @@ module "vpc" {
9393
create_flow_log_cloudwatch_iam_role = var.flow_log_enabled
9494
create_flow_log_cloudwatch_log_group = local.create_flow_log_cloudwatch_log_group
9595
flow_log_max_aggregation_interval = var.flow_log_max_aggregation_interval
96+
flow_log_cloudwatch_log_group_skip_destroy = var.flow_log_cloudwatch_log_group_skip_destroy
9697
flow_log_cloudwatch_log_group_retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
9798
flow_log_cloudwatch_log_group_kms_key_id = var.flow_log_cloudwatch_log_group_kms_key_arn
9899
enable_ipv6 = local.enable_ipv6
@@ -212,3 +213,108 @@ resource "aws_vpc_ipam_pool_cidr" "ipam_pool_cidr" {
212213
ipam_pool_id = var.create_ipam_pool ? aws_vpc_ipam_pool.ipam_pool[0].id : var.ipam_pool_id
213214
cidr = var.create_ipam_pool ? var.vpc_cidr : var.existing_ipam_managed_cidr
214215
}
216+
217+
# private links for S3
218+
219+
data "aws_route_tables" "aws_private_routes" {
220+
count = var.vpc_s3_endpoint_enabled ? 1 : 0
221+
depends_on = [module.vpc]
222+
vpc_id = module.vpc.vpc_id
223+
tags = {
224+
Name = "${var.environment}-${var.name}-private-route-table"
225+
}
226+
}
227+
228+
resource "aws_vpc_endpoint" "private-s3" {
229+
count = var.vpc_s3_endpoint_enabled ? 1 : 0
230+
depends_on = [data.aws_route_tables.aws_private_routes]
231+
vpc_id = module.vpc.vpc_id
232+
service_name = "com.amazonaws.${var.region}.s3"
233+
route_table_ids = data.aws_route_tables.aws_private_routes[0].ids
234+
vpc_endpoint_type = "Gateway"
235+
policy = <<POLICY
236+
{
237+
"Statement": [
238+
{
239+
"Action": "*",
240+
"Effect": "Allow",
241+
"Resource": "*",
242+
"Principal": "*"
243+
}
244+
]
245+
}
246+
POLICY
247+
tags = {
248+
Name = "${var.environment}-${var.name}-endpoint"
249+
}
250+
}
251+
252+
# allow 443 to access ecr repo
253+
resource "aws_security_group" "vpc_endpoints" {
254+
count = var.vpc_ecr_endpoint_enabled ? 1 : 0
255+
name_prefix = "${var.environment}-vpc-endpoints"
256+
description = "Associated to ECR/s3 VPC Endpoints"
257+
vpc_id = module.vpc.vpc_id
258+
259+
ingress {
260+
description = "Allow Nodes to pull images from ECR via VPC endpoints"
261+
protocol = "tcp"
262+
from_port = 443
263+
to_port = 443
264+
cidr_blocks = [var.vpc_cidr]
265+
}
266+
}
267+
# private links for ECR.dkr
268+
269+
resource "aws_vpc_endpoint" "private-ecr-dkr" {
270+
count = var.vpc_ecr_endpoint_enabled ? 1 : 0
271+
depends_on = [data.aws_route_tables.aws_private_routes]
272+
vpc_id = module.vpc.vpc_id
273+
service_name = "com.amazonaws.${var.region}.ecr.dkr"
274+
subnet_ids = module.vpc.private_subnets
275+
security_group_ids = [aws_security_group.vpc_endpoints[0].id]
276+
vpc_endpoint_type = "Interface"
277+
private_dns_enabled = true
278+
policy = <<POLICY
279+
{
280+
"Statement": [
281+
{
282+
"Action": "*",
283+
"Effect": "Allow",
284+
"Resource": "*",
285+
"Principal": "*"
286+
}
287+
]
288+
}
289+
POLICY
290+
tags = {
291+
Name = "${var.environment}-${var.name}-ecr-dkr-endpoint"
292+
}
293+
}
294+
295+
# private links for ECR.api
296+
297+
resource "aws_vpc_endpoint" "private-ecr-api" {
298+
count = var.vpc_ecr_endpoint_enabled ? 1 : 0
299+
depends_on = [data.aws_route_tables.aws_private_routes]
300+
vpc_id = module.vpc.vpc_id
301+
subnet_ids = module.vpc.private_subnets
302+
service_name = "com.amazonaws.${var.region}.ecr.api"
303+
vpc_endpoint_type = "Interface"
304+
private_dns_enabled = true
305+
policy = <<POLICY
306+
{
307+
"Statement": [
308+
{
309+
"Action": "ecr.api",
310+
"Effect": "Allow",
311+
"Resource": "*",
312+
"Principal": "*"
313+
}
314+
]
315+
}
316+
POLICY
317+
tags = {
318+
Name = "${var.environment}-${var.name}-ecr-api-endpoint"
319+
}
320+
}

‎variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -263,3 +263,21 @@ variable "existing_ipam_managed_cidr" {
263263
default = ""
264264
type = string
265265
}
266+
267+
variable "flow_log_cloudwatch_log_group_skip_destroy" {
268+
description = " Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state"
269+
type = bool
270+
default = false
271+
}
272+
273+
variable "vpc_s3_endpoint_enabled" {
274+
description = "Set to true if you want to enable vpc S3 endpoints"
275+
type = bool
276+
default = false
277+
}
278+
279+
variable "vpc_ecr_endpoint_enabled" {
280+
description = "Set to true if you want to enable vpc ecr endpoints"
281+
type = bool
282+
default = false
283+
}

0 commit comments

Comments
 (0)