Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

Add some TF fixes (#4834)

Browse Source
This commit is contained in:
Zachary Winnerman
2022-03-28 12:08:57 -04:00
committed by GitHub
parent 6697c57b5d
commit 0e9a3ff044
8 changed files with 44 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/loadtesting/terraform/ecs-iam.tf
+1 -1
View File
@@ -40,7 +40,7 @@ data "aws_iam_policy_document" "fleet" {
}
statement {
actions = [
actions = [ #tfsec:ignore:aws-iam-no-policy-wildcards
"kms:Encrypt*",
"kms:Decrypt*",
"kms:ReEncrypt*",
tools/loadtesting/terraform/ecs-sgs.tf
+4 -4
View File
@@ -13,7 +13,7 @@ resource "aws_security_group_rule" "lb-ingress" {
from_port = "443"
to_port = "443"
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
security_group_id = aws_security_group.lb.id
}
@@ -25,7 +25,7 @@ resource "aws_security_group_rule" "lb-http-ingress" {
from_port = "80"
to_port = "80"
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
security_group_id = aws_security_group.lb.id
}
@@ -72,7 +72,7 @@ resource "aws_security_group_rule" "lb-egress" {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
security_group_id = aws_security_group.lb.id
}
@@ -106,7 +106,7 @@ resource "aws_security_group_rule" "backend-egress" {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
security_group_id = aws_security_group.backend.id
}
tools/loadtesting/terraform/ecs.tf
+3 -3
View File
@@ -1,6 +1,6 @@
resource "aws_alb" "main" {
name = "fleetdm"
internal = false
internal = false #tfsec:ignore:aws-elb-alb-not-public
security_groups = [aws_security_group.lb.id, aws_security_group.backend.id]
subnets = module.vpc.public_subnets
idle_timeout = 600
@@ -21,7 +21,7 @@ resource "aws_alb" "internal" {
resource "aws_alb_listener" "https-fleetdm-internal" {
load_balancer_arn = aws_alb.internal.arn
port = 80
protocol = "HTTP"
protocol = "HTTP" #tfsec:ignore:aws-elb-http-not-used
default_action {
target_group_arn = aws_alb_target_group.internal.arn
@@ -141,7 +141,7 @@ resource "aws_ecs_service" "fleet" {
depends_on = [aws_alb_listener.http, aws_alb_listener.https-fleetdm]
}
resource "aws_cloudwatch_log_group" "backend" {
resource "aws_cloudwatch_log_group" "backend" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key
name = "fleetdm"
retention_in_days = 1
}
tools/loadtesting/terraform/elasticsearch.tf
+1 -1
View File
@@ -62,7 +62,7 @@ resource "aws_security_group_rule" "es-egress" {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
security_group_id = aws_security_group.elasticsearch.id
}
tools/loadtesting/terraform/firehose.tf
+21 -4
View File
@@ -1,4 +1,4 @@
resource "aws_s3_bucket" "osquery-results" {
resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging tfsec:ignore:aws-s3-enable-versioning
bucket = "fleet-loadtest-osquery-logs-archive"
acl = "private"
@@ -21,7 +21,16 @@ resource "aws_s3_bucket" "osquery-results" {
#checkov:skip=CKV_AWS_21:dev env
}
resource "aws_s3_bucket" "osquery-status" {
resource "aws_s3_bucket_public_access_block" "osquery-results" {
bucket = aws_s3_bucket.osquery-results.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
resource "aws_s3_bucket" "osquery-status" { #tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging tfsec:ignore:aws-s3-enable-versioning
bucket = "fleet-loadtest-osquery-status-archive"
acl = "private"
@@ -43,6 +52,14 @@ resource "aws_s3_bucket" "osquery-status" {
#checkov:skip=CKV_AWS_144:dev env
#checkov:skip=CKV_AWS_21:dev env
}
resource "aws_s3_bucket_public_access_block" "osquery-status" {
bucket = aws_s3_bucket.osquery-status.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
data "aws_iam_policy_document" "osquery_results_policy_doc" {
statement {
@@ -54,7 +71,7 @@ data "aws_iam_policy_document" "osquery_results_policy_doc" {
"s3:ListBucketMultipartUploads",
"s3:PutObject"
]
resources = [aws_s3_bucket.osquery-results.arn, "${aws_s3_bucket.osquery-results.arn}/*"]
resources = [aws_s3_bucket.osquery-results.arn, "${aws_s3_bucket.osquery-results.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards
}
}
@@ -68,7 +85,7 @@ data "aws_iam_policy_document" "osquery_status_policy_doc" {
"s3:ListBucketMultipartUploads",
"s3:PutObject"
]
resources = [aws_s3_bucket.osquery-status.arn, "${aws_s3_bucket.osquery-status.arn}/*"]
resources = [aws_s3_bucket.osquery-status.arn, "${aws_s3_bucket.osquery-status.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards
}
}
tools/loadtesting/terraform/loadtesting.tf
+6 -6
View File
@@ -3,7 +3,7 @@ resource "aws_ecs_service" "loadtest" {
launch_type = "FARGATE"
cluster = aws_ecs_cluster.fleet.id
task_definition = aws_ecs_task_definition.loadtest.arn
desired_count = var.scale_down ? 0 : 1
desired_count = var.scale_down ? 0 : 0
deployment_minimum_healthy_percent = 100
deployment_maximum_percent = 200
@@ -19,15 +19,15 @@ resource "aws_ecs_task_definition" "loadtest" {
requires_compatibilities = ["FARGATE"]
execution_role_arn = aws_iam_role.main.arn
task_role_arn = aws_iam_role.main.arn
cpu = 1024
memory = 2048
cpu = 256
memory = 512
container_definitions = jsonencode(
[
{
name = "loadtest"
image = docker_registry_image.loadtest.name
cpu = 1024
memory = 2048
cpu = 256
memory = 512
mountPoints = []
volumesFrom = []
essential = true
@@ -51,7 +51,7 @@ resource "aws_ecs_task_definition" "loadtest" {
command = [
"go", "run", "/go/fleet/cmd/osquery-perf/agent.go",
"-enroll_secret", data.aws_secretsmanager_secret_version.enroll_secret.secret_string,
"-host_count", "10000",
"-host_count", "5000",
"-server_url", "http://${aws_alb.internal.dns_name}",
"-node_key_file", "nodekeys",
"--policy_pass_prob", "0.5",
tools/loadtesting/terraform/rds.tf
+1 -1
View File
@@ -17,7 +17,7 @@ resource "aws_secretsmanager_secret_version" "database_password_secret_version"
secret_string = random_password.database_password.result
}
module "aurora_mysql" {
module "aurora_mysql" { #tfsec:ignore:aws-rds-enable-performance-insights-encryption tfsec:ignore:aws-rds-encrypt-cluster-storage-data tfsec:ignore:aws-vpc-add-description-to-security-group
source = "terraform-aws-modules/rds-aurora/aws"
version = "5.3.0"
tools/loadtesting/terraform/redis.tf
+7 -7
View File
@@ -11,14 +11,14 @@ resource "aws_elasticache_replication_group" "default" {
port = "6379"
snapshot_retention_limit = 0
automatic_failover_enabled = true
at_rest_encryption_enabled = false
transit_encryption_enabled = false
at_rest_encryption_enabled = false #tfsec:ignore:aws-elasticache-enable-at-rest-encryption
transit_encryption_enabled = false #tfsec:ignore:aws-elasticache-enable-in-transit-encryption
apply_immediately = true
replication_group_description = "fleetdm-redis"
}
resource "aws_elasticache_parameter_group" "default" {
resource "aws_elasticache_parameter_group" "default" { #tfsec:ignore:aws-vpc-add-description-to-security-group-rule
name = "fleetdm-redis-foobar"
family = "redis5.0"
@@ -32,7 +32,7 @@ resource "aws_elasticache_parameter_group" "default" {
}
}
resource "aws_security_group" "redis" {
resource "aws_security_group" "redis" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key tfsec:ignore:aws-vpc-add-description-to-security-group
name = local.security_group_name
vpc_id = module.vpc.vpc_id
}
@@ -41,7 +41,7 @@ locals {
security_group_name = "${local.prefix}-elasticache-redis"
}
resource "aws_security_group_rule" "ingress" {
resource "aws_security_group_rule" "ingress" { #tfsec:ignore:aws-vpc-add-description-to-security-group-rule
type = "ingress"
from_port = "6379"
to_port = "6379"
@@ -50,11 +50,11 @@ resource "aws_security_group_rule" "ingress" {
security_group_id = aws_security_group.redis.id
}
resource "aws_security_group_rule" "egress" {
resource "aws_security_group_rule" "egress" { #tfsec:ignore:aws-vpc-add-description-to-security-group-rule
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
security_group_id = aws_security_group.redis.id
}