Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Fix codeowners and revert pull 4798 as it stepped on 4834 (#4887)

Browse Source
This commit is contained in:
Zachary Winnerman
2022-03-31 12:36:18 -04:00
committed by GitHub
parent d3454bcfce
commit 2ea256b9b0
8 changed files with 40 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CODEOWNERS
+2 -1
View File
@@ -7,7 +7,8 @@ go.mod @fleetdm/go
/cmd/ @fleetdm/go
# Infra/terraform
*.tf @edwardsb
*.tf @edwardsb @zwinnerman-fleetdm
/tools/loadtesting/terraform @zwinnerman-fleetdm
# GitHub settings + actions
/.github/ @zwass
tools/loadtesting/terraform/ecs-iam.tf
-2
View File
@@ -39,8 +39,6 @@ data "aws_iam_policy_document" "fleet" {
resources = [aws_kinesis_firehose_delivery_stream.osquery_results.arn, aws_kinesis_firehose_delivery_stream.osquery_status.arn]
}
// We use wildcards on these actions for buckets that are single-use.
statement {
actions = [ #tfsec:ignore:aws-iam-no-policy-wildcards
"kms:Encrypt*",
tools/loadtesting/terraform/ecs-sgs.tf
+13 -16
View File
@@ -10,11 +10,11 @@ resource "aws_security_group_rule" "lb-ingress" {
description = "${local.prefix}: allow traffic from public internet"
type = "ingress"
from_port = "443"
to_port = "443"
protocol = "tcp"
// Internet connectivity here is by design
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
from_port = "443"
to_port = "443"
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
security_group_id = aws_security_group.lb.id
}
@@ -22,10 +22,9 @@ resource "aws_security_group_rule" "lb-http-ingress" {
description = "${local.prefix}: allow traffic from public internet"
type = "ingress"
from_port = "80"
to_port = "80"
protocol = "tcp"
// Internet connectivity here is by design
from_port = "80"
to_port = "80"
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
security_group_id = aws_security_group.lb.id
@@ -66,8 +65,7 @@ resource "aws_security_group_rule" "lb-kibana" {
}
# Allow outbound traffic
// Egress filtering is not currently provided by our Terraform templates.
resource "aws_security_group_rule" "lb-egress" { #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01
resource "aws_security_group_rule" "lb-egress" {
description = "${local.prefix}: allow all outbound traffic"
type = "egress"
@@ -105,11 +103,10 @@ resource "aws_security_group_rule" "backend-egress" {
description = "${local.prefix}: allow all outbound traffic"
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
// Egress filtering is not currently provided by our Terraform templates.
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
security_group_id = aws_security_group.backend.id
}
tools/loadtesting/terraform/ecs.tf
+4 -7
View File
@@ -1,6 +1,5 @@
resource "aws_alb" "main" {
name = "fleetdm"
// Exposed to the Internet by design
name = "fleetdm"
internal = false #tfsec:ignore:aws-elb-alb-not-public
security_groups = [aws_security_group.lb.id, aws_security_group.backend.id]
subnets = module.vpc.public_subnets
@@ -22,8 +21,7 @@ resource "aws_alb" "internal" {
resource "aws_alb_listener" "https-fleetdm-internal" {
load_balancer_arn = aws_alb.internal.arn
port = 80
// We will evaluate removing all HTTP eventually, including the removal of HTTP redirects.
protocol = "HTTP" #tfsec:ignore:aws-elb-http-not-used:exp:2022-06-01
protocol = "HTTP" #tfsec:ignore:aws-elb-http-not-used
default_action {
target_group_arn = aws_alb_target_group.internal.arn
@@ -142,9 +140,8 @@ resource "aws_ecs_service" "fleet" {
depends_on = [aws_alb_listener.http, aws_alb_listener.https-fleetdm]
}
// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the
// possibility of providing this capability in the future.
resource "aws_cloudwatch_log_group" "backend" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key:exp:2022-07-01
resource "aws_cloudwatch_log_group" "backend" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key
name = "fleetdm"
retention_in_days = 1
}
tools/loadtesting/terraform/elasticsearch.tf
+4 -5
View File
@@ -59,11 +59,10 @@ resource "aws_security_group_rule" "es-egress" {
description = "${local.prefix}: allow all outbound traffic"
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
// Egress filtering is not currently provided by our Terraform templates.
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
security_group_id = aws_security_group.elasticsearch.id
}
tools/loadtesting/terraform/firehose.tf
+5 -25
View File
@@ -1,10 +1,4 @@
// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the
// possibility of providing this capability in the future.
// No versioning on this bucket is by design.
// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the
// organizations deploying Fleet, and we will evaluate the possibility of providing this capability
// in the future.
resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging tfsec:ignore:aws-s3-enable-versioning
bucket = "fleet-loadtest-osquery-logs-archive"
acl = "private"
@@ -28,19 +22,15 @@ resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-cus
}
resource "aws_s3_bucket_public_access_block" "osquery-results" {
bucket = aws_s3_bucket.osquery-results.id
bucket = aws_s3_bucket.osquery-results.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the
// possibility of providing this capability in the future.
// No versioning on this bucket is by design.
// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the
// organizations deploying Fleet, and we will evaluate the possibility of providing this capability
// in the future.
resource "aws_s3_bucket" "osquery-status" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
resource "aws_s3_bucket" "osquery-status" { #tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging tfsec:ignore:aws-s3-enable-versioning
bucket = "fleet-loadtest-osquery-status-archive"
acl = "private"
@@ -71,14 +61,6 @@ resource "aws_s3_bucket_public_access_block" "osquery-status" {
restrict_public_buckets = true
}
resource "aws_s3_bucket_public_access_block" "osquery-status" {
bucket = aws_s3_bucket.osquery-status.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
data "aws_iam_policy_document" "osquery_results_policy_doc" {
statement {
effect = "Allow"
@@ -89,7 +71,6 @@ data "aws_iam_policy_document" "osquery_results_policy_doc" {
"s3:ListBucketMultipartUploads",
"s3:PutObject"
]
// This bucket is single-purpose and using a wildcard is not problematic
resources = [aws_s3_bucket.osquery-results.arn, "${aws_s3_bucket.osquery-results.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards
}
}
@@ -104,7 +85,6 @@ data "aws_iam_policy_document" "osquery_status_policy_doc" {
"s3:ListBucketMultipartUploads",
"s3:PutObject"
]
// This bucket is single-purpose and using a wildcard is not problematic
resources = [aws_s3_bucket.osquery-status.arn, "${aws_s3_bucket.osquery-status.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards
}
}
tools/loadtesting/terraform/rds.tf
+1 -1
View File
@@ -47,7 +47,7 @@ module "aurora_mysql" { #tfsec:ignore:aws-rds-enable-performance-insights-encryp
replica_scale_enabled = true
replica_scale_min = var.scale_down ? 0 : 1
replica_scale_max = var.scale_down ? 0 : 3
snapshot_identifier = "arn:aws:rds:us-east-2:917007347864:cluster-snapshot:bens-thing"
snapshot_identifier = "arn:aws:rds:us-east-2:917007347864:cluster-snapshot:cleaned"
monitoring_interval = 60
iam_role_name = "${local.name}-rds-enhanced-monitoring"
tools/loadtesting/terraform/redis.tf
+11 -15
View File
@@ -11,8 +11,8 @@ resource "aws_elasticache_replication_group" "default" {
port = "6379"
snapshot_retention_limit = 0
automatic_failover_enabled = true
at_rest_encryption_enabled = true
transit_encryption_enabled = true
at_rest_encryption_enabled = false #tfsec:ignore:aws-elasticache-enable-at-rest-encryption
transit_encryption_enabled = false #tfsec:ignore:aws-elasticache-enable-in-transit-encryption
apply_immediately = true
replication_group_description = "fleetdm-redis"
@@ -33,17 +33,15 @@ resource "aws_elasticache_parameter_group" "default" { #tfsec:ignore:aws-vpc-add
}
resource "aws_security_group" "redis" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key tfsec:ignore:aws-vpc-add-description-to-security-group
name = local.security_group_name
description = "Security group for Redis"
vpc_id = module.vpc.vpc_id
name = local.security_group_name
vpc_id = module.vpc.vpc_id
}
locals {
security_group_name = "${local.prefix}-elasticache-redis"
}
resource "aws_security_group_rule" "ingress" {
description = "Redis from private VPC"
resource "aws_security_group_rule" "ingress" { #tfsec:ignore:aws-vpc-add-description-to-security-group-rule
type = "ingress"
from_port = "6379"
to_port = "6379"
@@ -52,13 +50,11 @@ resource "aws_security_group_rule" "ingress" {
security_group_id = aws_security_group.redis.id
}
resource "aws_security_group_rule" "egress" {
description = "Redis VPC egress"
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
// Egress filtering is not currently provided by our Terraform templates.
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01
resource "aws_security_group_rule" "egress" { #tfsec:ignore:aws-vpc-add-description-to-security-group-rule
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
security_group_id = aws_security_group.redis.id
}