Skip to content

Commit c10f789

Browse files
bjfish25bjfish25
authored
Switch from deny and allow config, to only deny and allow everything … (#467)
* Switch from deny and allow config, to only deny and allow everything else * Update changelog * Upgrade go module version * Upgrade terraform
1 parent e28c6e0 commit c10f789

13 files changed

Lines changed: 71 additions & 175 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
## v0.35.0
2+
3+
- Add: Added blanket * allow permission in place of specific allow permissions for easier integration with future AWS products github.com/Optum/dce (#467)
14

25
## v0.34.2
36

@@ -7,7 +10,7 @@
710

811
- Add: Enable network-firewall:ListRuleGroups permission (#449)
912
- Fix: Recent changes to AWS S3 default bucket policy have broken the install. Removing ACL from the bucket allows the installation to proceed.
10-
13+
1114
## v0.34.0
1215

1316
- Fix: get latest aws-nuke release. (#432)

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/Optum/dce
22

3-
go 1.19
3+
go 1.20
44

55
require (
66
github.com/360EntSecGroup-Skylar/excelize v1.4.1

‎go.sum‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym
2525
github.com/CloudyKit/fastprinter v0.0.0-20200109182630-33d98a066a53/go.mod h1:+3IMCy2vIlbG1XG/0ggNQv0SvxCAIpPM5b1nCz56Xno=
2626
github.com/CloudyKit/jet/v3 v3.0.0/go.mod h1:HKQPgSJmdK8hdoAbKUUWajkHyHo4RaU5rMdUywE7VMo=
2727
github.com/Joker/hpp v1.0.0/go.mod h1:8x5n+M1Hp5hC0g8okX3sR3vFQwynaX/UgSOM9MeBKzY=
28-
github.com/Optum/aws-nuke/v2 v2.0.0 h1:kCF9BuHvaQI+OJu1CBAWMAL1YFgQSIu4Mhnv6wDk8vU=
29-
github.com/Optum/aws-nuke/v2 v2.0.0/go.mod h1:vHiOieYSFzuprJ0gAlc4sfYn27RnrpsN465Y9rlBr6c=
3028
github.com/Optum/aws-nuke/v2 v2.0.1 h1:9wjFuNLcjcfC94dNEa8/Xgxl9xciIFyUeB0CXN3vFbQ=
3129
github.com/Optum/aws-nuke/v2 v2.0.1/go.mod h1:vHiOieYSFzuprJ0gAlc4sfYn27RnrpsN465Y9rlBr6c=
3230
github.com/Shopify/goreferrer v0.0.0-20181106222321-ec9c9a553398/go.mod h1:a1uqRtAwp2Xwc6WNPJEufxJ7fx3npB4UV/JOLmbu5I0=

‎modules/accounts_lambda.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ module "accounts_lambda" {
3030
PRINCIPAL_MAX_SESSION_DURATION = 14400
3131
TAG_ENVIRONMENT = var.namespace == "prod" ? "PROD" : "NON-PROD"
3232
TAG_APP_NAME = lookup(var.global_tags, "AppName")
33-
PRINCIPAL_POLICY_S3_KEY = aws_s3_bucket_object.principal_policy.key
33+
PRINCIPAL_POLICY_S3_KEY = aws_s3_object.principal_policy.key
3434
}
3535
}
3636

‎modules/artifacts_bucket.tf‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,24 @@ resource "aws_s3_bucket" "artifacts" {
1616
# (so ephemeral PR environments can be torn down)
1717
force_destroy = true
1818

19-
# Encrypt objects by default
20-
server_side_encryption_configuration {
21-
rule {
22-
apply_server_side_encryption_by_default {
23-
sse_algorithm = "AES256"
24-
}
19+
tags = var.global_tags
20+
}
21+
22+
resource "aws_s3_bucket_server_side_encryption_configuration" "artifacts" {
23+
bucket = aws_s3_bucket.artifacts.id
24+
25+
rule {
26+
apply_server_side_encryption_by_default {
27+
sse_algorithm = "AES256"
2528
}
2629
}
30+
}
2731

28-
versioning {
29-
enabled = true
32+
resource "aws_s3_bucket_versioning" "artifacts" {
33+
bucket = aws_s3_bucket.artifacts.id
34+
versioning_configuration {
35+
status = "Enabled"
3036
}
31-
32-
tags = var.global_tags
3337
}
3438

3539
# Enforce SSL only access to the bucket
@@ -58,7 +62,7 @@ POLICY
5862

5963
}
6064

61-
resource "aws_s3_bucket_object" "principal_policy" {
65+
resource "aws_s3_object" "principal_policy" {
6266
bucket = aws_s3_bucket.artifacts.id
6367
key = "fixtures/policies/principal_policy.tmpl"
6468
source = local.principal_policy

‎modules/authentication/iam.tf‎

Lines changed: 16 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,31 @@
1-
data "template_file" "user_assume_role_policy" {
2-
template = file("${path.module}/fixtures/iam/assume-role.json")
3-
4-
vars = {
1+
locals {
2+
user_assume_role_policy = templatefile("${path.module}/fixtures/iam/assume-role.json", {
53
cognito_identity_pool_id = aws_cognito_identity_pool._.id
6-
}
7-
}
4+
})
85

9-
data "template_file" "user_policy" {
10-
template = file("${path.module}/fixtures/iam/user-policy.json")
6+
user_policy = templatefile("${path.module}/fixtures/iam/user-policy.json", {
7+
api_gateway_arn = var.api_gateway_arn
8+
})
119

12-
vars = {
10+
admin_assume_role_policy = templatefile("${path.module}/fixtures/iam/assume-role.json", {
11+
cognito_identity_pool_id = aws_cognito_identity_pool._.id
12+
})
13+
14+
admin_policy = templatefile("${path.module}/fixtures/iam/admin-policy.json", {
1315
api_gateway_arn = var.api_gateway_arn
14-
}
16+
})
1517
}
1618

1719
resource "aws_iam_role" "user" {
1820
name = "${var.name}-user-${var.namespace}"
1921

20-
assume_role_policy = data.template_file.user_assume_role_policy.rendered
22+
assume_role_policy = local.user_assume_role_policy
2123
}
2224

2325
resource "aws_iam_policy" "user" {
2426
name = "${var.name}-user-${var.namespace}"
2527

26-
policy = data.template_file.user_policy.rendered
28+
policy = local.user_policy
2729
}
2830
resource "aws_iam_policy_attachment" "user" {
2931
name = "${var.name}-user-${var.namespace}"
@@ -32,33 +34,16 @@ resource "aws_iam_policy_attachment" "user" {
3234
roles = [aws_iam_role.user.name]
3335
}
3436

35-
36-
data "template_file" "admin_assume_role_policy" {
37-
template = file("${path.module}/fixtures/iam/assume-role.json")
38-
39-
vars = {
40-
cognito_identity_pool_id = aws_cognito_identity_pool._.id
41-
}
42-
}
43-
44-
data "template_file" "admin_policy" {
45-
template = file("${path.module}/fixtures/iam/admin-policy.json")
46-
47-
vars = {
48-
api_gateway_arn = var.api_gateway_arn
49-
}
50-
}
51-
5237
resource "aws_iam_role" "admin" {
5338
name = "${var.name}-admin-${var.namespace}"
5439

55-
assume_role_policy = data.template_file.admin_assume_role_policy.rendered
40+
assume_role_policy = local.admin_assume_role_policy
5641
}
5742

5843
resource "aws_iam_policy" "admin" {
5944
name = "${var.name}-admin-${var.namespace}"
6045

61-
policy = data.template_file.admin_policy.rendered
46+
policy = local.admin_policy
6247
}
6348
resource "aws_iam_policy_attachment" "admin" {
6449
name = "${var.name}-admin-${var.namespace}"

‎modules/fixtures/policies/principal_policy.tmpl‎

Lines changed: 1 addition & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -68,108 +68,7 @@
6868
"Sid": "AllowedServices",
6969
"Effect": "Allow",
7070
"Action": [
71-
"acm:*",
72-
"acm-pca:*",
73-
"apigateway:*",
74-
"application-autoscaling:*",
75-
"appstream:*",
76-
"athena:*",
77-
"autoscaling:*",
78-
"backup:*",
79-
"backup-storage:MountCapsule",
80-
"batch:*",
81-
"cloud9:*",
82-
"clouddirectory:*",
83-
"cloudformation:*",
84-
"cloudfront:*",
85-
"cloudhsm:*",
86-
"cloudsearch:*",
87-
"cloudtrail:*",
88-
"cloudwatch:*",
89-
"codebuild:*",
90-
"codecommit:*",
91-
"codedeploy:*",
92-
"codepipeline:*",
93-
"codestar:*",
94-
"cognito-identity:*",
95-
"cognito-idp:*",
96-
"comprehend:*",
97-
"config:*",
98-
"datapipeline:*",
99-
"dax:*",
100-
"devicefarm:*",
101-
"dms:*",
102-
"ds:*",
103-
"dynamodb:*",
104-
"ec2:*",
105-
"ecr:*",
106-
"ecs:*",
107-
"eks:*",
108-
"elasticache:*",
109-
"elasticbeanstalk:*",
110-
"elasticfilesystem:*",
111-
"elasticloadbalancing:*",
112-
"elasticmapreduce:*",
113-
"elastictranscoder:*",
114-
"es:*",
115-
"events:*",
116-
"execute-api:*",
117-
"firehose:*",
118-
"fms:*",
119-
"fsx:*",
120-
"globalaccelerator:*",
121-
"glue:*",
122-
"iam:*",
123-
"imagebuilder:*",
124-
"iot:*",
125-
"iotanalytics:*",
126-
"kafka:*",
127-
"kinesis:*",
128-
"kinesisanalytics:*",
129-
"kinesisvideo:*",
130-
"kms:*",
131-
"lakeformation:*",
132-
"lambda:*",
133-
"lex:*",
134-
"lightsail:*",
135-
"logs:*",
136-
"machinelearning:*",
137-
"mediaconvert:*",
138-
"medialive:*",
139-
"mediapackage:*",
140-
"mediastore:*",
141-
"mediatailor:*",
142-
"mobilehub:*",
143-
"mq:*",
144-
"neptune-db:*",
145-
"network-firewall:*",
146-
"opsworks:*",
147-
"opsworks-cm:*",
148-
"rds:*",
149-
"redshift:*",
150-
"rekognition:*",
151-
"resource-groups:*",
152-
"robomaker:*",
153-
"route53:*",
154-
"s3:*",
155-
"sagemaker:*",
156-
"secretsmanager:*",
157-
"servicecatalog:*",
158-
"servicediscovery:*",
159-
"ses:*",
160-
"sns:*",
161-
"sqs:*",
162-
"ssm:*",
163-
"states:*",
164-
"storagegateway:*",
165-
"sts:*",
166-
"tag:*",
167-
"transfer:*",
168-
"waf:*",
169-
"wafv2:*",
170-
"waf-regional:*",
171-
"worklink:*",
172-
"workspaces:*"
71+
"*"
17372
],
17473
"Resource": "*",
17574
"Condition": {

‎modules/gateway.tf‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,21 @@
11
locals {
22
portal_gateway_name = "${var.namespace_prefix}-${var.namespace}"
33
stage_name = "api"
4+
5+
api_swagger_tpl = templatefile("${path.module}/swagger.yaml", {
6+
leases_lambda = module.leases_lambda.invoke_arn
7+
lease_auth_lambda = module.lease_auth_lambda.invoke_arn
8+
accounts_lambda = module.accounts_lambda.invoke_arn
9+
usages_lambda = module.usage_lambda.invoke_arn
10+
credentials_web_page_lambda = module.credentials_web_page_lambda.invoke_arn
11+
namespace = "${var.namespace_prefix}-${var.namespace}"
12+
})
413
}
514

615
resource "aws_api_gateway_rest_api" "gateway_api" {
716
name = local.portal_gateway_name
817
description = local.portal_gateway_name
9-
body = data.template_file.api_swagger.rendered
18+
body = local.api_swagger_tpl
1019
}
1120

1221
module "api_gateway_authorizer" {
@@ -54,19 +63,6 @@ resource "aws_ssm_parameter" "user_pool_endpoint" {
5463
value = module.api_gateway_authorizer.user_pool_endpoint
5564
}
5665

57-
data "template_file" "api_swagger" {
58-
template = file("${path.module}/swagger.yaml")
59-
60-
vars = {
61-
leases_lambda = module.leases_lambda.invoke_arn
62-
lease_auth_lambda = module.lease_auth_lambda.invoke_arn
63-
accounts_lambda = module.accounts_lambda.invoke_arn
64-
usages_lambda = module.usage_lambda.invoke_arn
65-
credentials_web_page_lambda = module.credentials_web_page_lambda.invoke_arn
66-
namespace = "${var.namespace_prefix}-${var.namespace}"
67-
}
68-
}
69-
7066
resource "aws_lambda_permission" "allow_api_gateway" {
7167
function_name = module.leases_lambda.arn
7268
statement_id = "AllowExecutionFromApiGateway"
@@ -122,7 +118,7 @@ resource "aws_api_gateway_deployment" "gateway_deployment" {
122118
// API Changes won't get deployed, without a trigger in TF
123119
// See https://medium.com/coryodaniel/til-forcing-terraform-to-deploy-a-aws-api-gateway-deployment-ed36a9f60c1a
124120
// and https://github.com/terraform-providers/terraform-provider-aws/issues/162#issuecomment-475323730
125-
change_trigger = sha256(data.template_file.api_swagger.rendered)
121+
change_trigger = sha256(local.api_swagger_tpl)
126122
}
127123

128124
lifecycle {

‎modules/main.tf‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
11
terraform {
2-
required_version = "~>0.12.31"
2+
required_version = "~>0.13.7"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 5.25.0"
8+
}
9+
}
310
}
411

512
provider "aws" {
613
region = var.aws_region
7-
version = "3.41.0"
814
}
915

1016
# Current AWS Account User
@@ -15,4 +21,3 @@ locals {
1521
account_id = data.aws_caller_identity.current.account_id
1622
sns_encryption_key_id = "alias/aws/sns"
1723
}
18-

‎modules/update_lease_status.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ module "update_lease_status_lambda" {
4444
BUDGET_NOTIFICATION_FROM_EMAIL = var.budget_notification_from_email
4545
BUDGET_NOTIFICATION_BCC_EMAILS = join(",", var.budget_notification_bcc_emails)
4646
BUDGET_NOTIFICATION_TEMPLATES_BUCKET = local.budget_notification_templates_bucket
47-
BUDGET_NOTIFICATION_TEMPLATE_HTML_KEY = aws_s3_bucket_object.budget_notification_template_html.key
48-
BUDGET_NOTIFICATION_TEMPLATE_TEXT_KEY = aws_s3_bucket_object.budget_notification_template_text.key
47+
BUDGET_NOTIFICATION_TEMPLATE_HTML_KEY = aws_s3_object.budget_notification_template_html.key
48+
BUDGET_NOTIFICATION_TEMPLATE_TEXT_KEY = aws_s3_object.budget_notification_template_text.key
4949
BUDGET_NOTIFICATION_TEMPLATE_SUBJECT = var.budget_notification_template_subject
5050
BUDGET_NOTIFICATION_THRESHOLD_PERCENTILES = join(",", var.budget_notification_threshold_percentiles)
5151
PRINCIPAL_BUDGET_AMOUNT = var.principal_budget_amount
@@ -56,12 +56,12 @@ module "update_lease_status_lambda" {
5656

5757
// Upload budget notification email templates to S3
5858
// (templates may be too large to pass in as env vars)
59-
resource "aws_s3_bucket_object" "budget_notification_template_html" {
59+
resource "aws_s3_object" "budget_notification_template_html" {
6060
bucket = local.budget_notification_templates_bucket
6161
key = "budget_notification_templates/html.tmpl"
6262
content = var.budget_notification_template_html
6363
}
64-
resource "aws_s3_bucket_object" "budget_notification_template_text" {
64+
resource "aws_s3_object" "budget_notification_template_text" {
6565
bucket = local.budget_notification_templates_bucket
6666
key = "budget_notification_templates/text.tmpl"
6767
content = var.budget_notification_template_text

0 commit comments

Comments
 (0)