Files

T

Jorge Falcon def4b33206 AWS Region Terraform deprecation fixes (#87 )

- aws_region Terraform attribute `name` has been deprecated in favor of
`region`, introduced in v6 of the hashicorp/aws provider.
- Updated
  - `addons/byo-firehose-logging-destination/target-account/firehose.tf`
  - `addons/external-vuln-scans/main.tf`
  - `addons/logging-alb/main.tf`
  - `addons/logging-destination-datadog/outputs.tf`
  - `addons/mdmproxy/main.tf`
  - `addons/migrations/main.tf`
  - `addons/saml-auth-proxy/main.tf`
  - `addons/xrays-sidecar/outputs.tf`
  - `byo-vpc/byo-db/byo-ecs/main.tf`
  - `byo-vpc/byo-db/byo-ecs/outputs.tf`

2025-08-11 11:49:01 -04:00

4.1 KiB

Raw Permalink Blame History

External Vulnerability Scans addon

This addon creates an additional ECS service that only runs a single task, responsible for vuln processing. It receives no web traffic. We utilize current instance checks to make this happen. The advantages of this mechanism:

dedicating processing power to vuln processing 2. ensures task responsible for vuln processing isn't also trying to serve web traffic
caching of vulnerability artifacts/dependencies

Usage is simplified by using the output from the fleet byo-ecs module (../terraform/byo-vpc/byo-db/byo-ecs/README.md)

Requirements

No requirements.

Providers

Name	Version
aws	6.8.0

Modules

No modules.

Resources

Name	Type
aws_ecs_service.fleet	resource
aws_ecs_task_definition.vuln-processing	resource
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
awslogs_config	n/a	object({ group = string region = string prefix = string })	n/a	yes
customer_prefix	n/a	`string`	`"fleet"`	no
ecs_cluster	The ecs cluster module that is created by the byo-db module	`any`	n/a	yes
execution_iam_role_arn	The ARN of the fleet execution role, this is necessary to pass role from ecs events	`any`	n/a	yes
fleet_config	The root Fleet config object	`any`	n/a	yes
fleet_s3_software_installers_config	use the output of the byo-vpc module with the same name	`map(string)`	n/a	yes
fleet_server_private_key_secret_arn	The ARN of the secret that stores the Fleet private key	`string`	n/a	yes
security_groups	n/a	`list(string)`	n/a	yes
subnets	n/a	`list(string)`	n/a	yes
task_role_arn	The ARN of the fleet task role, this is necessary to pass role from ecs events	`any`	n/a	yes
vuln_processing_cpu	The amount of CPU to dedicate to the vuln processing command	`number`	`1024`	no
vuln_processing_memory	The amount of memory to dedicate to the vuln processing command	`number`	`4096`	no
vuln_processing_task_cpu	The amount of CPU to dedicate to the vuln processing task including sidecars	`number`	`1024`	no
vuln_processing_task_memory	The amount of memory to dedicate to the vuln processing task including sidecars	`number`	`4096`	no

Outputs

Name	Description
extra_environment_variables	n/a
vuln_service_arn	n/a

4.1 KiB Raw Permalink Blame History