Skip to content

Commit 9802a61

Browse files
snovikovsnovikov
authored
OPS-6929 Update to aws v6 and refactor (#4)
* OPS-6929 Add key rotation for KMS key * OPS-6929 Update CI * OPS-6929 Add validation method for certificate
1 parent 169d228 commit 9802a61

11 files changed

Lines changed: 85 additions & 77 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: "/"
5+
schedule:
6+
interval: weekly
7+
day: monday
8+
time: "08:00"
9+
timezone: Europe/Berlin

‎.github/workflows/lint.yml‎

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,9 @@
11
---
2-
3-
# -------------------------------------------------------------------------------------------------
4-
# Job Name
5-
# -------------------------------------------------------------------------------------------------
62
name: lint
73

8-
9-
# -------------------------------------------------------------------------------------------------
10-
# When to run
11-
# -------------------------------------------------------------------------------------------------
124
on:
13-
# Runs on Pull Requests
145
pull_request:
156

16-
17-
# -------------------------------------------------------------------------------------------------
18-
# What to run
19-
# -------------------------------------------------------------------------------------------------
207
jobs:
218
lint:
229
name: "Lint"
@@ -29,17 +16,10 @@ jobs:
2916
- gen
3017

3118
steps:
32-
# ------------------------------------------------------------
33-
# Setup repository
34-
# ------------------------------------------------------------
3519
- name: Checkout repository
36-
uses: actions/checkout@v2
20+
uses: actions/checkout@v5
3721
with:
3822
fetch-depth: 0
39-
40-
# ------------------------------------------------------------
41-
# Lint repository
42-
# ------------------------------------------------------------
4323
- name: "make ${{ matrix.target }}"
4424
run: |
4525
retry() {

‎.github/workflows/release-drafter.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,19 @@
1+
---
12
name: Release Drafter
23

34
on:
45
push:
5-
# branches to consider in the event; optional, defaults to all
66
branches:
77
- master
88

9+
permissions:
10+
contents: write
11+
pull-requests: write
12+
913
jobs:
1014
update_release_draft:
1115
runs-on: ubuntu-latest
1216
steps:
13-
- uses: release-drafter/release-drafter@v5
17+
- uses: release-drafter/release-drafter@v6
1418
env:
1519
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,16 @@
11
---
2-
3-
# -------------------------------------------------------------------------------------------------
4-
# Job Name
5-
# -------------------------------------------------------------------------------------------------
62
name: test
73

8-
9-
# -------------------------------------------------------------------------------------------------
10-
# When to run
11-
# -------------------------------------------------------------------------------------------------
124
on:
13-
# Runs on Pull Requests
145
pull_request:
156

16-
17-
# -------------------------------------------------------------------------------------------------
18-
# What to run
19-
# -------------------------------------------------------------------------------------------------
207
jobs:
218
test:
229
name: Test
2310
runs-on: ubuntu-latest
2411
steps:
25-
26-
# ------------------------------------------------------------
27-
# Checkout repository
28-
# ------------------------------------------------------------
2912
- name: Checkout repository
30-
uses: actions/checkout@v2
13+
uses: actions/checkout@v5
3114
with:
3215
fetch-depth: 0
3316

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,6 @@ override.tf.json
2020

2121
# Vars file
2222
/*.tfvars
23+
24+
#IDEA
25+
.idea

‎Makefile‎

Lines changed: 43 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ endif
44

55
.PHONY: help gen lint test _gen-main _gen-examples _gen-modules _lint-files _lint-fmt _lint-json _pull-tf _pull-tfdocs _pull-fl _pull-jl
66

7-
CURRENT_DIR = $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
8-
TF_EXAMPLES = $(sort $(dir $(wildcard $(CURRENT_DIR)examples/*/)))
9-
TF_MODULES = $(sort $(dir $(wildcard $(CURRENT_DIR)modules/*/)))
7+
CURRENT_DIR = $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
8+
TF_EXAMPLES = $(sort $(dir $(wildcard $(CURRENT_DIR)examples/*/)))
9+
TF_MODULES = $(sort $(dir $(wildcard $(CURRENT_DIR)modules/*/)))
10+
FL_IGNORE_PATHS = .git/,.github/,.terraform/,.idea/
1011

1112
# -------------------------------------------------------------------------------------------------
1213
# Container versions
@@ -16,7 +17,6 @@ TFDOCS_VERSION = 0.16.0-0.34
1617
FL_VERSION = latest-0.8
1718
JL_VERSION = 1.6.0-0.14
1819

19-
2020
# -------------------------------------------------------------------------------------------------
2121
# Enable linter (file-lint, terraform fmt, jsonlint)
2222
# -------------------------------------------------------------------------------------------------
@@ -77,7 +77,9 @@ test: _pull-tf
7777
echo "------------------------------------------------------------"; \
7878
echo "# Terraform init"; \
7979
echo "------------------------------------------------------------"; \
80-
if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" --workdir "$${DOCKER_PATH}" hashicorp/terraform:$(TF_VERSION) \
80+
if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" \
81+
--workdir "$${DOCKER_PATH}" --network host \
82+
hashicorp/terraform:$(TF_VERSION) \
8183
init \
8284
-lock=false \
8385
-upgrade \
@@ -88,22 +90,30 @@ test: _pull-tf
8890
echo "OK"; \
8991
else \
9092
echo "Failed"; \
91-
docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" --workdir "$${DOCKER_PATH}" --entrypoint=rm hashicorp/terraform:$(TF_VERSION) -rf .terraform/ || true; \
93+
docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" \
94+
--workdir "$${DOCKER_PATH}" --network none --entrypoint=rm \
95+
hashicorp/terraform:$(TF_VERSION) -rf .terraform/ || true; \
9296
exit 1; \
9397
fi; \
9498
echo; \
9599
echo "------------------------------------------------------------"; \
96100
echo "# Terraform validate"; \
97101
echo "------------------------------------------------------------"; \
98-
if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" --workdir "$${DOCKER_PATH}" hashicorp/terraform:$(TF_VERSION) \
102+
if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" \
103+
--workdir "$${DOCKER_PATH}" --network host \
104+
hashicorp/terraform:$(TF_VERSION) \
99105
validate \
100106
$(ARGS) \
101107
.; then \
102108
echo "OK"; \
103-
docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" --workdir "$${DOCKER_PATH}" --entrypoint=rm hashicorp/terraform:$(TF_VERSION) -rf .terraform/ || true; \
109+
docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" \
110+
--workdir "$${DOCKER_PATH}" --network none --entrypoint=rm \
111+
hashicorp/terraform:$(TF_VERSION) -rf .terraform/ || true; \
104112
else \
105113
echo "Failed"; \
106-
docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" --workdir "$${DOCKER_PATH}" --entrypoint=rm hashicorp/terraform:$(TF_VERSION) -rf .terraform/ || true; \
114+
docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" \
115+
--workdir "$${DOCKER_PATH}" --network none --entrypoint=rm \
116+
hashicorp/terraform:$(TF_VERSION) -rf .terraform/ || true; \
107117
exit 1; \
108118
fi; \
109119
echo; \
@@ -117,7 +127,7 @@ _gen-main:
117127
@echo "------------------------------------------------------------"
118128
@echo "# Main module"
119129
@echo "------------------------------------------------------------"
120-
@if docker run $$(tty -s && echo "-it" || echo) --rm \
130+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
121131
-v $(CURRENT_DIR):/data \
122132
-e DELIM_START='<!-- TFDOCS_HEADER_START -->' \
123133
-e DELIM_CLOSE='<!-- TFDOCS_HEADER_END -->' \
@@ -128,7 +138,7 @@ _gen-main:
128138
echo "Failed"; \
129139
exit 1; \
130140
fi
131-
@if docker run $$(tty -s && echo "-it" || echo) --rm \
141+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
132142
-v $(CURRENT_DIR):/data \
133143
-e DELIM_START='<!-- TFDOCS_PROVIDER_START -->' \
134144
-e DELIM_CLOSE='<!-- TFDOCS_PROVIDER_END -->' \
@@ -139,7 +149,7 @@ _gen-main:
139149
echo "Failed"; \
140150
exit 1; \
141151
fi
142-
@if docker run $$(tty -s && echo "-it" || echo) --rm \
152+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
143153
-v $(CURRENT_DIR):/data \
144154
-e DELIM_START='<!-- TFDOCS_REQUIREMENTS_START -->' \
145155
-e DELIM_CLOSE='<!-- TFDOCS_REQUIREMENTS_END -->' \
@@ -150,7 +160,7 @@ _gen-main:
150160
echo "Failed"; \
151161
exit 1; \
152162
fi
153-
@if docker run $$(tty -s && echo "-it" || echo) --rm \
163+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
154164
-v $(CURRENT_DIR):/data \
155165
-e DELIM_START='<!-- TFDOCS_INPUTS_START -->' \
156166
-e DELIM_CLOSE='<!-- TFDOCS_INPUTS_END -->' \
@@ -161,7 +171,7 @@ _gen-main:
161171
echo "Failed"; \
162172
exit 1; \
163173
fi
164-
@if docker run $$(tty -s && echo "-it" || echo) --rm \
174+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
165175
-v $(CURRENT_DIR):/data \
166176
-e DELIM_START='<!-- TFDOCS_OUTPUTS_START -->' \
167177
-e DELIM_CLOSE='<!-- TFDOCS_OUTPUTS_END -->' \
@@ -180,7 +190,7 @@ _gen-examples:
180190
echo "------------------------------------------------------------"; \
181191
echo "# $${DOCKER_PATH}"; \
182192
echo "------------------------------------------------------------"; \
183-
if docker run $$(tty -s && echo "-it" || echo) --rm \
193+
if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
184194
-v $(CURRENT_DIR):/data \
185195
-e DELIM_START='$(DELIM_START)' \
186196
-e DELIM_CLOSE='$(DELIM_CLOSE)' \
@@ -200,7 +210,7 @@ _gen-modules:
200210
echo "------------------------------------------------------------"; \
201211
echo "# $${DOCKER_PATH}"; \
202212
echo "------------------------------------------------------------"; \
203-
if docker run $$(tty -s && echo "-it" || echo) --rm \
213+
if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
204214
-v $(CURRENT_DIR):/data \
205215
-e DELIM_START='$(DELIM_START)' \
206216
-e DELIM_CLOSE='$(DELIM_CLOSE)' \
@@ -218,12 +228,12 @@ _lint-files: _pull-fl
218228
@echo "################################################################################"
219229
@echo "# File-lint"
220230
@echo "################################################################################"
221-
@docker run $$(tty -s && echo "-it" || echo) --rm -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-cr --text --ignore '.git/,.github/,.terraform/' --path .
222-
@docker run $$(tty -s && echo "-it" || echo) --rm -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-crlf --text --ignore '.git/,.github/,.terraform/' --path .
223-
@docker run $$(tty -s && echo "-it" || echo) --rm -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-trailing-single-newline --text --ignore '.git/,.github/,.terraform/' --path .
224-
@docker run $$(tty -s && echo "-it" || echo) --rm -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-trailing-space --text --ignore '.git/,.github/,.terraform/' --path .
225-
@docker run $$(tty -s && echo "-it" || echo) --rm -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-utf8 --text --ignore '.git/,.github/,.terraform/' --path .
226-
@docker run $$(tty -s && echo "-it" || echo) --rm -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-utf8-bom --text --ignore '.git/,.github/,.terraform/' --path .
231+
@docker run $$(tty -s && echo "-it" || echo) --rm --network none -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-cr --text --ignore '$(FL_IGNORE_PATHS)' --path .
232+
@docker run $$(tty -s && echo "-it" || echo) --rm --network none -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-crlf --text --ignore '$(FL_IGNORE_PATHS)' --path .
233+
@docker run $$(tty -s && echo "-it" || echo) --rm --network none -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-trailing-single-newline --text --ignore '$(FL_IGNORE_PATHS)' --path .
234+
@docker run $$(tty -s && echo "-it" || echo) --rm --network none -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-trailing-space --text --ignore '$(FL_IGNORE_PATHS)' --path .
235+
@docker run $$(tty -s && echo "-it" || echo) --rm --network none -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-utf8 --text --ignore '$(FL_IGNORE_PATHS)' --path .
236+
@docker run $$(tty -s && echo "-it" || echo) --rm --network none -v $(CURRENT_DIR):/data cytopia/file-lint:$(FL_VERSION) file-utf8-bom --text --ignore '$(FL_IGNORE_PATHS)' --path .
227237

228238
_lint-fmt: _pull-tf
229239
@# Lint all Terraform files
@@ -234,8 +244,10 @@ _lint-fmt: _pull-tf
234244
@echo "------------------------------------------------------------"
235245
@echo "# *.tf files"
236246
@echo "------------------------------------------------------------"
237-
@if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t:ro" --workdir "/t" hashicorp/terraform:$(TF_VERSION) \
238-
fmt -recursive -check=true -diff=true -write=false -list=true .; then \
247+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network host \
248+
-v "$(CURRENT_DIR):/t:ro" --workdir "/t" \
249+
hashicorp/terraform:$(TF_VERSION) \
250+
fmt -recursive -check=true -diff=true -write=true -list=true .; then \
239251
echo "OK"; \
240252
else \
241253
echo "Failed"; \
@@ -245,8 +257,10 @@ _lint-fmt: _pull-tf
245257
@echo "------------------------------------------------------------"
246258
@echo "# *.tfvars files"
247259
@echo "------------------------------------------------------------"
248-
@if docker run $$(tty -s && echo "-it" || echo) --rm --entrypoint=/bin/sh -v "$(CURRENT_DIR):/t:ro" --workdir "/t" hashicorp/terraform:$(TF_VERSION) \
249-
-c "find . -name '*.tfvars' -type f -print0 | xargs -0 -n1 terraform fmt -check=true -write=false -diff=true -list=true"; then \
260+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network host \
261+
--entrypoint=/bin/sh -v "$(CURRENT_DIR):/t:ro" --workdir "/t" \
262+
hashicorp/terraform:$(TF_VERSION) \
263+
-c "find . -name '*.tfvars' -type f -print0 | xargs -0 -n1 terraform fmt -check=true -write=true -diff=true -list=true"; then \
250264
echo "OK"; \
251265
else \
252266
echo "Failed"; \
@@ -259,7 +273,9 @@ _lint-json: _pull-jl
259273
@echo "################################################################################"
260274
@echo "# Jsonlint"
261275
@echo "################################################################################"
262-
@if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/data:ro" cytopia/jsonlint:$(JL_VERSION) \
276+
@if docker run $$(tty -s && echo "-it" || echo) --rm --network none \
277+
-v "$(CURRENT_DIR):/data:ro" \
278+
cytopia/jsonlint:$(JL_VERSION) \
263279
-t ' ' -i '*.terraform/*' '*.json'; then \
264280
echo "OK"; \
265281
else \

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717

1818
| Name | Version |
1919
|------|---------|
20-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5 |
20+
| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 6.14 |
2121

2222
<!-- TFDOCS_PROVIDER_END -->
2323

@@ -26,8 +26,8 @@
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
30-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5 |
29+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5 |
30+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 6.14 |
3131

3232
<!-- TFDOCS_REQUIREMENTS_END -->
3333

‎data.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ data "aws_route53_zone" "opensearch" {
1010
data "aws_iam_policy_document" "access_policy" {
1111
statement {
1212
actions = ["es:*"]
13-
resources = ["arn:aws:es:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:domain/${var.cluster_name}/*"]
13+
resources = ["arn:aws:es:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:domain/${var.cluster_name}/*"]
1414

1515
principals {
1616
type = "AWS"

‎main.tf‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,22 @@
11
# Create the AWS KMS key
2-
resource "aws_kms_key" "opensearch_encryption_key" {
2+
resource "aws_kms_key" "this" {
33
description = "KMS key for OpenSearch cluster encryption"
4+
enable_key_rotation = true
5+
rotation_period_in_days = 365
46
deletion_window_in_days = 10
57
}
68

9+
resource "aws_kms_alias" "this" {
10+
name = "alias/${var.cluster_name}/storage"
11+
target_key_id = aws_kms_key.this.key_id
12+
}
13+
714
module "acm" {
815
count = (var.custom_endpoint_certificate_arn != "") ? 0 : 1
916
source = "terraform-aws-modules/acm/aws"
10-
version = "~> 4.3.1"
17+
version = "5.2.0"
18+
19+
validation_method = "DNS"
1120

1221
domain_name = "${var.cluster_name}.${data.aws_route53_zone.opensearch.name}"
1322
zone_id = data.aws_route53_zone.opensearch.id
@@ -78,7 +87,7 @@ resource "aws_opensearch_domain" "opensearch" {
7887

7988
encrypt_at_rest {
8089
enabled = true
81-
kms_key_id = aws_kms_key.opensearch_encryption_key.key_id
90+
kms_key_id = aws_kms_key.this.key_id
8291
}
8392

8493
dynamic "ebs_options" {

‎moved.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
moved {
2+
from = aws_kms_key.opensearch_encryption_key
3+
to = aws_kms_key.this
4+
}

0 commit comments

Comments
 (0)