From 2ea256b9b0fa33f1811df7c2806d7a8f9db0fefe Mon Sep 17 00:00:00 2001 From: Zachary Winnerman <98712682+zwinnerman-fleetdm@users.noreply.github.com> Date: Thu, 31 Mar 2022 12:36:18 -0400 Subject: [PATCH] Fix codeowners and revert pull 4798 as it stepped on 4834 (#4887) --- CODEOWNERS | 3 +- tools/loadtesting/terraform/ecs-iam.tf | 2 -- tools/loadtesting/terraform/ecs-sgs.tf | 29 +++++++++---------- tools/loadtesting/terraform/ecs.tf | 11 +++---- tools/loadtesting/terraform/elasticsearch.tf | 9 +++--- tools/loadtesting/terraform/firehose.tf | 30 ++++---------------- tools/loadtesting/terraform/rds.tf | 2 +- tools/loadtesting/terraform/redis.tf | 26 +++++++---------- 8 files changed, 40 insertions(+), 72 deletions(-) diff --git a/CODEOWNERS b/CODEOWNERS index c5abfcacf7..f0d2d371b8 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -7,7 +7,8 @@ go.mod @fleetdm/go /cmd/ @fleetdm/go # Infra/terraform -*.tf @edwardsb +*.tf @edwardsb @zwinnerman-fleetdm +/tools/loadtesting/terraform @zwinnerman-fleetdm # GitHub settings + actions /.github/ @zwass diff --git a/tools/loadtesting/terraform/ecs-iam.tf b/tools/loadtesting/terraform/ecs-iam.tf index 0b6063f8b3..f628953e9f 100644 --- a/tools/loadtesting/terraform/ecs-iam.tf +++ b/tools/loadtesting/terraform/ecs-iam.tf @@ -39,8 +39,6 @@ data "aws_iam_policy_document" "fleet" { resources = [aws_kinesis_firehose_delivery_stream.osquery_results.arn, aws_kinesis_firehose_delivery_stream.osquery_status.arn] } - - // We use wildcards on these actions for buckets that are single-use. statement { actions = [ #tfsec:ignore:aws-iam-no-policy-wildcards "kms:Encrypt*", diff --git a/tools/loadtesting/terraform/ecs-sgs.tf b/tools/loadtesting/terraform/ecs-sgs.tf index 8b7feacbf9..449dd5ddb0 100644 --- a/tools/loadtesting/terraform/ecs-sgs.tf +++ b/tools/loadtesting/terraform/ecs-sgs.tf @@ -10,11 +10,11 @@ resource "aws_security_group_rule" "lb-ingress" { description = "${local.prefix}: allow traffic from public internet" type = "ingress" - from_port = "443" - to_port = "443" - protocol = "tcp" - // Internet connectivity here is by design - cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr + from_port = "443" + to_port = "443" + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr + security_group_id = aws_security_group.lb.id } @@ -22,10 +22,9 @@ resource "aws_security_group_rule" "lb-http-ingress" { description = "${local.prefix}: allow traffic from public internet" type = "ingress" - from_port = "80" - to_port = "80" - protocol = "tcp" - // Internet connectivity here is by design + from_port = "80" + to_port = "80" + protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr security_group_id = aws_security_group.lb.id @@ -66,8 +65,7 @@ resource "aws_security_group_rule" "lb-kibana" { } # Allow outbound traffic -// Egress filtering is not currently provided by our Terraform templates. -resource "aws_security_group_rule" "lb-egress" { #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01 +resource "aws_security_group_rule" "lb-egress" { description = "${local.prefix}: allow all outbound traffic" type = "egress" @@ -105,11 +103,10 @@ resource "aws_security_group_rule" "backend-egress" { description = "${local.prefix}: allow all outbound traffic" type = "egress" - from_port = 0 - to_port = 0 - protocol = "-1" - // Egress filtering is not currently provided by our Terraform templates. - cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01 + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr security_group_id = aws_security_group.backend.id } diff --git a/tools/loadtesting/terraform/ecs.tf b/tools/loadtesting/terraform/ecs.tf index f4b34d7a00..87e0168e95 100644 --- a/tools/loadtesting/terraform/ecs.tf +++ b/tools/loadtesting/terraform/ecs.tf @@ -1,6 +1,5 @@ resource "aws_alb" "main" { - name = "fleetdm" - // Exposed to the Internet by design + name = "fleetdm" internal = false #tfsec:ignore:aws-elb-alb-not-public security_groups = [aws_security_group.lb.id, aws_security_group.backend.id] subnets = module.vpc.public_subnets @@ -22,8 +21,7 @@ resource "aws_alb" "internal" { resource "aws_alb_listener" "https-fleetdm-internal" { load_balancer_arn = aws_alb.internal.arn port = 80 - // We will evaluate removing all HTTP eventually, including the removal of HTTP redirects. - protocol = "HTTP" #tfsec:ignore:aws-elb-http-not-used:exp:2022-06-01 + protocol = "HTTP" #tfsec:ignore:aws-elb-http-not-used default_action { target_group_arn = aws_alb_target_group.internal.arn @@ -142,9 +140,8 @@ resource "aws_ecs_service" "fleet" { depends_on = [aws_alb_listener.http, aws_alb_listener.https-fleetdm] } -// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the -// possibility of providing this capability in the future. -resource "aws_cloudwatch_log_group" "backend" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key:exp:2022-07-01 + +resource "aws_cloudwatch_log_group" "backend" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key name = "fleetdm" retention_in_days = 1 } diff --git a/tools/loadtesting/terraform/elasticsearch.tf b/tools/loadtesting/terraform/elasticsearch.tf index d98dc3b066..aa18bc64cd 100644 --- a/tools/loadtesting/terraform/elasticsearch.tf +++ b/tools/loadtesting/terraform/elasticsearch.tf @@ -59,11 +59,10 @@ resource "aws_security_group_rule" "es-egress" { description = "${local.prefix}: allow all outbound traffic" type = "egress" - from_port = 0 - to_port = 0 - protocol = "-1" - // Egress filtering is not currently provided by our Terraform templates. - cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01 + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr security_group_id = aws_security_group.elasticsearch.id } diff --git a/tools/loadtesting/terraform/firehose.tf b/tools/loadtesting/terraform/firehose.tf index e8ecad3345..c73a0d6fe2 100644 --- a/tools/loadtesting/terraform/firehose.tf +++ b/tools/loadtesting/terraform/firehose.tf @@ -1,10 +1,4 @@ -// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the -// possibility of providing this capability in the future. -// No versioning on this bucket is by design. -// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the -// organizations deploying Fleet, and we will evaluate the possibility of providing this capability -// in the future. -resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15 +resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging tfsec:ignore:aws-s3-enable-versioning bucket = "fleet-loadtest-osquery-logs-archive" acl = "private" @@ -28,19 +22,15 @@ resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-cus } resource "aws_s3_bucket_public_access_block" "osquery-results" { - bucket = aws_s3_bucket.osquery-results.id + bucket = aws_s3_bucket.osquery-results.id + block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } -// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the -// possibility of providing this capability in the future. -// No versioning on this bucket is by design. -// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the -// organizations deploying Fleet, and we will evaluate the possibility of providing this capability -// in the future. -resource "aws_s3_bucket" "osquery-status" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15 + +resource "aws_s3_bucket" "osquery-status" { #tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging tfsec:ignore:aws-s3-enable-versioning bucket = "fleet-loadtest-osquery-status-archive" acl = "private" @@ -71,14 +61,6 @@ resource "aws_s3_bucket_public_access_block" "osquery-status" { restrict_public_buckets = true } -resource "aws_s3_bucket_public_access_block" "osquery-status" { - bucket = aws_s3_bucket.osquery-status.id - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true -} - data "aws_iam_policy_document" "osquery_results_policy_doc" { statement { effect = "Allow" @@ -89,7 +71,6 @@ data "aws_iam_policy_document" "osquery_results_policy_doc" { "s3:ListBucketMultipartUploads", "s3:PutObject" ] - // This bucket is single-purpose and using a wildcard is not problematic resources = [aws_s3_bucket.osquery-results.arn, "${aws_s3_bucket.osquery-results.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards } } @@ -104,7 +85,6 @@ data "aws_iam_policy_document" "osquery_status_policy_doc" { "s3:ListBucketMultipartUploads", "s3:PutObject" ] - // This bucket is single-purpose and using a wildcard is not problematic resources = [aws_s3_bucket.osquery-status.arn, "${aws_s3_bucket.osquery-status.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards } } diff --git a/tools/loadtesting/terraform/rds.tf b/tools/loadtesting/terraform/rds.tf index 757cd5dca7..fd3f830fa7 100644 --- a/tools/loadtesting/terraform/rds.tf +++ b/tools/loadtesting/terraform/rds.tf @@ -47,7 +47,7 @@ module "aurora_mysql" { #tfsec:ignore:aws-rds-enable-performance-insights-encryp replica_scale_enabled = true replica_scale_min = var.scale_down ? 0 : 1 replica_scale_max = var.scale_down ? 0 : 3 - snapshot_identifier = "arn:aws:rds:us-east-2:917007347864:cluster-snapshot:bens-thing" + snapshot_identifier = "arn:aws:rds:us-east-2:917007347864:cluster-snapshot:cleaned" monitoring_interval = 60 iam_role_name = "${local.name}-rds-enhanced-monitoring" diff --git a/tools/loadtesting/terraform/redis.tf b/tools/loadtesting/terraform/redis.tf index dad7351a18..726efcfc26 100644 --- a/tools/loadtesting/terraform/redis.tf +++ b/tools/loadtesting/terraform/redis.tf @@ -11,8 +11,8 @@ resource "aws_elasticache_replication_group" "default" { port = "6379" snapshot_retention_limit = 0 automatic_failover_enabled = true - at_rest_encryption_enabled = true - transit_encryption_enabled = true + at_rest_encryption_enabled = false #tfsec:ignore:aws-elasticache-enable-at-rest-encryption + transit_encryption_enabled = false #tfsec:ignore:aws-elasticache-enable-in-transit-encryption apply_immediately = true replication_group_description = "fleetdm-redis" @@ -33,17 +33,15 @@ resource "aws_elasticache_parameter_group" "default" { #tfsec:ignore:aws-vpc-add } resource "aws_security_group" "redis" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key tfsec:ignore:aws-vpc-add-description-to-security-group - name = local.security_group_name - description = "Security group for Redis" - vpc_id = module.vpc.vpc_id + name = local.security_group_name + vpc_id = module.vpc.vpc_id } locals { security_group_name = "${local.prefix}-elasticache-redis" } -resource "aws_security_group_rule" "ingress" { - description = "Redis from private VPC" +resource "aws_security_group_rule" "ingress" { #tfsec:ignore:aws-vpc-add-description-to-security-group-rule type = "ingress" from_port = "6379" to_port = "6379" @@ -52,13 +50,11 @@ resource "aws_security_group_rule" "ingress" { security_group_id = aws_security_group.redis.id } -resource "aws_security_group_rule" "egress" { - description = "Redis VPC egress" - type = "egress" - from_port = 0 - to_port = 0 - protocol = "-1" - // Egress filtering is not currently provided by our Terraform templates. - cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr:exp:2022-10-01 +resource "aws_security_group_rule" "egress" { #tfsec:ignore:aws-vpc-add-description-to-security-group-rule + type = "egress" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr security_group_id = aws_security_group.redis.id }